The Agent Skills Directory

[REMOTE_CODE_EXECUTION]: The HTML template explicitly configures the Mermaid.js library with securityLevel: "loose".
This setting overrides default safety sandbox constraints and permits the execution of arbitrary JavaScript and HTML tags embedded within diagram definitions.
If the agent processes untrusted codebase content to generate these reports, an attacker could inject malicious scripts that execute in the user's browser when the report is viewed.
[DATA_EXFILTRATION]: The skill is designed to upload internal analysis reports, architecture diagrams, and dependency graphs to GitHub Gists.
Although created as 'secret' gists, these files are unlisted but publicly accessible to anyone with the raw URL.
This potentially exposes sensitive internal system architecture or proprietary business logic to the public internet.
[COMMAND_EXECUTION]: The skill uses the GitHub CLI (gh) to perform network operations and data uploads.
It executes gh gist create to upload local file content to external servers.
It uses gh api and gh gist list combined with shell utilities like awk to extract and manipulate remote resource identifiers.
[EXTERNAL_DOWNLOADS]: The generated HTML reports depend on external assets fetched from third-party Content Delivery Networks (CDNs) at runtime.
It loads the Tailwind CSS framework from https://cdn.tailwindcss.com.
It imports the Mermaid.js library from https://cdn.jsdelivr.net.
While these are well-known services, the skill relies on their availability and integrity to render reports correctly.

publish-html-report