The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data from project files or other skill outputs to generate HTML and later reads user-provided comments and marks back from these files, which creates an indirect prompt injection surface.
Ingestion points: The skill reads arbitrary project files (using the Read tool) and captures output from wrapped skills to populate HTML content. It also reads back a JSON state block from saved HTML files.
Boundary markers: The design uses a dedicated, structured JSON <script id="state"> block to store feedback and data-anchor attributes to bind feedback to specific content, which reduces the risk of parsing ambiguity.
Capability inventory: The skill possesses the Write, Artifact, Skill, and Bash tools. It can execute other skills or perform tasks based on the feedback read from the HTML state.
Sanitization: The skill employs basic escaping (replace(/</g, "\\u003c")) when writing the state block to prevent malicious comments from breaking the HTML script tag, though explicit sanitization for all input content is not detailed.
[EXTERNAL_DOWNLOADS]: The generated HTML pages reference external assets from a well-known service.
Evidence: The document skeleton in references/page-kit.md includes a stylesheet link to Google Fonts (https://fonts.googleapis.com/css2?...). This is a standard and expected practice for web artifacts and does not pose a security risk.

render