The Agent Skills Directory

[OBFUSCATION]: The file demo/index.html contains a large Base64-encoded string (encodedHtml) that stores the complete source code of a landing page. This content is hidden from plain-text analysis until decoded at runtime.
[DYNAMIC_EXECUTION]: The demo/index.html file uses a script to decode the Base64 content and inject it into a sandboxed iframe via the srcdoc attribute. This runtime generation and execution of scripts is a bypass technique often used to execute code that wasn't present in the static file.
[INDIRECT_PROMPT_INJECTION]: Instructions in demo/PROMPT.md direct the agent to fetch and analyze an external URL (https://neuform.ai/pages/cedar-lodges-where-the-mountains-breathe-6/index.html) to recreate its design. This exposes the agent to instructions that could be hidden in the external site's metadata or comments.
[EXTERNAL_DOWNLOADS]: The skill's demo configuration in demo/source.json and demo/index.html references dependencies from well-known services including Google Fonts, Fontshare, and CDNs for libraries like GSAP and Three.js.

number-details