The Agent Skills Directory

[SAFE]: Comprehensive analysis of the instructions and scripts found no evidence of malicious patterns, obfuscation, or attempts to bypass security controls. The skill follows its stated purpose of art-directing design content.
[EXTERNAL_DOWNLOADS]: The example.html file references typography from Google Fonts (fonts.googleapis.com and fonts.gstatic.com). These are well-known and trusted services for web assets and do not pose a security risk in this context.
[PROMPT_INJECTION]: The skill includes a surface for indirect prompt injection as it processes user-provided inputs to generate report content. However, the risk is minimal and inherent to the task of content generation.
Ingestion points: User inputs for annual report topics, audience, and data points enter the context through parameters defined in SKILL.md and open-design.json.
Boundary markers: The instructions do not specify any delimiters or safety warnings for handling embedded instructions within user data.
Capability inventory: The skill employs fs:write (as specified in the open-design.json capabilities) to produce the final slide deck artifact.
Sanitization: There is no evidence of explicit validation or sanitization of user-provided content before it is interpolated into the HTML template.

fs-editorial-forest