The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted markdown input and generates a '.md' twin intended to be used as machine context in future agent interactions, creating a surface for indirect prompt injection.
Ingestion points: The markdown argument provided to the skill in SKILL.md acts as the primary entry point for untrusted data.
Boundary markers: The instructions do not define specific delimiters or instructions to ignore potential commands embedded within the source markdown when generating the agent-facing '.md' twin.
Capability inventory: The skill has access to the Bash, Write, Read, Edit, Grep, and Glob tools. It specifically utilizes Bash to execute file-opening commands (open, xdg-open, start).
Sanitization: While SKILL.md mentions stripping tags and scripts when extracting facts from legacy HTML, it does not specify a sanitization process for the primary rendering flow from input markdown to the machine-context twin.
[EXTERNAL_DOWNLOADS]: The skill's templates and documentation reference external resources from well-known and established services.
Evidence: SKILL.md, references/fonts.md, and the mustache templates reference fonts.googleapis.com, fonts.gstatic.com, and cdn.jsdelivr.net.
Context: These connections are used to fetch Pretendard, Noto Sans/Serif KR, and JetBrains Mono fonts to ensure typography consistency and Korean readability.
[REMOTE_CODE_EXECUTION]: The generated HTML reports include a remote JavaScript library for rendering structural diagrams, which executes in the user's browser.
Evidence: SKILL.md and the templates (for basic and learn tiers) include a script tag that imports the Mermaid JS library from cdn.jsdelivr.net/npm/mermaid@11/dist/mermaid.esm.min.mjs.
Context: This is used to render flowcharts and state diagrams in the human-facing report and is paired with a <noscript> fallback for offline or JS-disabled environments.
[COMMAND_EXECUTION]: The skill instructs the agent to execute platform-specific commands to automatically open the generated report for the user.
Evidence: SKILL.md contains a bash script block that uses open (macOS), xdg-open (Linux), and start (Windows) to display the output file.
Context: This is a core feature intended to provide immediate feedback to the user once the rendering is complete.

moai-domain-html-report