The Agent Skills Directory

[OBFUSCATION]: The file demo/index.html contains a large Base64-encoded string assigned to the variable encodedHtml. This string decodes to a complete HTML document that includes JavaScript logic and WebGL shader code. This technique hides the executable content from simple text-based security scanners.- [DYNAMIC_EXECUTION]: The demo in demo/index.html employs a dynamic loading mechanism where it decodes Base64 data, creates a Blob from the resulting bytes, and then uses URL.createObjectURL to generate temporary URLs for loading resources into a sandboxed iframe via the srcdoc attribute. This allows for the execution of code that is not present in the static source.- [INDIRECT_PROMPT_INJECTION]: The skill is designed to process user prompts and product briefs to generate visual designs and background effects. This creates an attack surface where malicious instructions could be embedded in the processed data to influence the agent's behavior during the design generation process.
Ingestion points: The skill ingests user-provided text prompts, product concepts, and 'subject tags' (specified in demo/PROMPT.md) to drive the WebGL rendering and layout composition.
Boundary markers: Absent; the skill instructions do not specify any delimiters or safety markers (e.g., 'ignore embedded instructions') to separate user-provided content from the agent's core instructions.
Capability inventory: The skill possesses the capability to generate and execute JavaScript/WebGL code, manipulate the DOM structure of a page, and load external assets via the browser.
Sanitization: Absent; there is no mention of input validation, escaping, or sanitization of the user-provided prompts before they are incorporated into the final output.

background-grid-webgl