The Agent Skills Directory

[DATA_EXFILTRATION]: The skill reads local project files (SPECs, tickets, change proposals) to generate reports. It strictly mandates an offline-only approach, explicitly forbidding the use of remote fonts, CDNs, or external services, effectively preventing data exfiltration to external domains.
[INDIRECT_PROMPT_INJECTION]: The skill processes potentially untrusted data from project records. It mitigates injection risks by providing multiple explicit instructions to escape all source text as content and never execute it, ensuring that embedded instructions in the source data do not influence the agent's logic.
[COMMAND_EXECUTION]: Skill operations are restricted to file system read/write actions for report generation and history management. The included Python test suite uses standard library modules like re and unittest for static verification of the skill's assets and does not execute external shell commands or network calls.
[OBFUSCATION]: The instructions, CSS, and HTML templates are written in clear, plain text. No base64 encoding, zero-width characters, or homoglyph substitutions were detected in the scripts or markdown files.
[DYNAMIC_EXECUTION]: The skill utilizes a stable, template-based approach for generating HTML output from skeleton.html. It avoids dynamic code generation or the use of eval()/exec() and maintains a strict boundary between report data and executable logic.

light-html-plan