The Agent Skills Directory

[REMOTE_CODE_EXECUTION]: The skill instructs the agent to download an HTML file from a remote server and then execute it by rendering it in a browser and invoking internal validation methods. This creates a direct path for executing remote code from an unverified source.
Evidence: The curl command in SKILL.md downloads the file Bento_Slides.bento.html from https://bento.page/releases/slides/Bento_Slides.bento.html.
Evidence: references/output-and-qa.md instructs the agent to "Open the generated .bento.html in a browser and run: window.bento.validate()".
[EXTERNAL_DOWNLOADS]: The skill requires fetching resources from an external domain that is not recognized as a trusted source.
Evidence: https://bento.page/releases/slides/Bento_Slides.bento.html is downloaded in SKILL.md.
Evidence: https://bento.page/slides/agents.md is fetched as an authoring guide.
[COMMAND_EXECUTION]: The skill uses the curl command to download external files.
Evidence: curl -fsSL https://bento.page/releases/slides/Bento_Slides.bento.html -o "<name>.bento.html" in SKILL.md.
[INDIRECT_PROMPT_INJECTION]: The skill is designed to analyze and convert untrusted HTML content, which is a significant attack surface for indirect prompt injection.
Ingestion points: The skill accepts HTML files, folders, or URLs of live presentations as input in SKILL.md.
Boundary markers: While the skill uses a #bento-doc tag for the output, there are no specific boundary markers or instructions to ignore embedded commands in the input data.
Capability inventory: The agent has access to curl for network requests, file writing, and a browser context for rendering and executing JavaScript.
Sanitization: The instructions include a warning to use an "isolated browser context" and to "Remove executable/unsafe content", but these are dependent on the agent's correct interpretation and implementation during processing.

html-to-bento-slides