The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill provides instructions and a metadata file (references/google-fonts.txt) for downloading TrueType fonts from Google's official gstatic domain (fonts.gstatic.com). These resources are from a well-known and trusted service, intended for document styling.
[COMMAND_EXECUTION]: The instructions include standard commands for setting up a development environment, such as npm install, pip install, and pdftoppm. These are typical for the claimed functionality of PDF generation and previewing.
[INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest data to generate reports, invoices, and other documents, creating a potential surface for indirect prompt injection if untrusted data is processed.
Ingestion points: User-provided content for the PDF templates (e.g., text, titles, data rows).
Boundary markers: None identified in the provided templates.
Capability inventory: File system writing via @react-pdf/renderer's renderToFile and network access suggested for font downloads.
Sanitization: No specific sanitization or validation steps are included for the input data before it is rendered into the PDF.
[DYNAMIC_EXECUTION]: The skill recommends using tsx to execute TypeScript and JSX files. While this involves runtime compilation and execution, it is a standard approach for the Node.js/React ecosystem and fits the skill's primary purpose.

react-pdf