The Agent Skills Directory

Dynamic Module Loading: The scripts/build-decks.mjs file uses dynamic import() to load and execute bundle.mjs scripts from individual deck directories. This is a standard pattern for build systems to execute per-deck logic, allowing for extensibility. The implementation includes security considerations by verifying that the targets are regular files and not symbolic links before loading.
Indirect Prompt Injection Surface: The skill processes user-provided content (HTML, CSS, and JavaScript) from the slides/ directory to create standalone bundles, which represents a potential surface for indirect prompt injection.
Ingestion points: Source files like index.html, content.js, theme.css, and deck.json are read by templates/deck/bundle.mjs during the bundling process.
Boundary markers: The bundling process relies on structural parsing of the HTML document rather than specific isolation delimiters.
Capability inventory: The skill's capabilities include writing files to docs/slides/, executing npm commands, and dynamically importing local modules.
Sanitization: The templates/deck/bundle.mjs script performs significant validation, such as rejecting inline styles, CSS imports, and unsafe HTML raw-text delimiters in JavaScript, which helps ensure the integrity of the generated presentations.
Secure File Operations: The scripts/create-deck.mjs script implements high-security standards for file handling. It includes protections against path traversal and Time-of-Check to Time-of-Use (TOCTOU) vulnerabilities by using stable file handles and verifying file properties before performing operations.

hve-slides