The Agent Skills Directory

[OBFUSCATION]: The file demo/index.html contains a large Base64-encoded string assigned to the constant encodedHtml. This string encodes the full HTML content of the demo page, which is decoded at runtime to be displayed in a sandboxed iframe. This technique conceals the demo's source code from static analysis.
[DYNAMIC_EXECUTION]: The demo loader in demo/index.html uses atob to decode the bundled content and injects it into an iframe via the srcdoc attribute. Additionally, it uses URL.createObjectURL to dynamically generate URLs for binary assets (images and scripts) sent from the parent window. This mechanism allows the execution of dynamically reconstructed code and resources.
[INDIRECT_PROMPT_INJECTION]: The demo/PROMPT.md file directs the agent to use both the local demo/index.html and an external URL (https://neuform.ai/pages/auralis-neural-audio-engine/index.html) as primary visual and structural references. This creates an ingestion surface where instructions or patterns in the reference material could influence the agent's behavior, although the skill lacks the high-privilege capabilities required for severe exploitation.
[EXTERNAL_DOWNLOADS]: The demo environment is configured to fetch fonts and runtime scripts from external sources, including Google Fonts, Fontshare, and CDNs like Cloudflare and Iconify. These references target well-known services and are documented within the skill's metadata (demo/source.json).

beautiful-shadows