The Agent Skills Directory

[DYNAMIC_EXECUTION]: The skill's HTML templates (template/board-geo.html, template/board.html) implement a custom expression evaluator evalExpr that utilizes the Function constructor. This mechanism is used to evaluate mathematical expressions at runtime that are defined in the skill's generated data island. While the execution is scoped, this pattern allows for the evaluation of strings as JavaScript code within the context of the user's browser.
[INDIRECT_PROMPT_INJECTION]: The skill processes user-provided geometry problem descriptions and solution steps, which are later injected into the generated HTML using the .innerHTML property (e.g., document.getElementById('prob-body').innerHTML). There is no evidence of sanitization or escaping applied to this content, creating a vulnerability surface for Cross-Site Scripting (XSS).
Ingestion points: The lesson.problem and steps.content fields within the JSON data injected into the HTML templates.
Boundary markers: None implemented for the descriptive text fields.
Capability inventory: The skill has the capability to write files to the current working directory and execute scripts via shell commands.
Sanitization: Absent; the template directly assigns untrusted strings to .innerHTML for rendering.
[COMMAND_EXECUTION]: The instructions in SKILL.md direct the agent to generate a temporary Python build script in /tmp, execute it to assemble the final HTML page, and subsequently delete it. This involves the dynamic generation and execution of code on the host machine.
[EXTERNAL_DOWNLOADS]: The generated HTML output fetches external styling and typesetting libraries from well-known services including cdn.tailwindcss.com and cdnjs.cloudflare.com for layout and math formula rendering.

edu-plane-geometry