The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill's primary function is to assemble fragments and JSON data into a single HTML page. This process interpolates untrusted or externally-provided content into the generated page's source code, creating a surface for indirect prompt injection.\n
Ingestion points: assets/assemble.py reads content from fragment files; assets/preview.py reads data from JSON files.\n
Boundary markers: The skill relies on structural delimiters defined in assets/FRAGMENT-CONTRACT.md but lacks explicit warnings to the agent about ignoring potentially malicious instructions within processed data.\n
Capability inventory: The skill uses assets/assemble.py to write the final HTML artifact to the file system and assets/check.py to launch a browser environment via Playwright for validation.\n
Sanitization: The assets/assemble.py script validates against a list of forbidden HTML tags (like iframe, object, embed) and enforces script IIFE wrapping. However, assets/preview.py explicitly allows raw HTML tags (e.g., <b>, <code>, <a>) in several fields.\n- [EXTERNAL_DOWNLOADS]: The skill references external resources from well-known services.\n
assets/kit.js fetches Geist and other fonts from Google Fonts (fonts.googleapis.com).\n
assets/check.py requires the playwright library for automated testing, which downloads browser binaries.\n
assets/assemble.py whitelists specific well-known CDNs (cdnjs.cloudflare.com, cdn.jsdelivr.net, unpkg.com) for external script inclusion in fragments.

explainer-kit