The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The scripts/generate-presentation.js script processes external JSON data to generate HTML slides but lacks consistent input sanitization. 1. Ingestion points: The presentation content provided via the --input argument in scripts/generate-presentation.js. 2. Boundary markers: No delimiters or safety instructions are present to distinguish slide content from the HTML template structure. 3. Capability inventory: The skill performs file writes via fs.writeFileSync and uses Playwright for browser automation in scripts/export-slides.js. 4. Sanitization: While an escapeHtml function is defined, it is only applied to specific fields like code blocks and terminal lines. Main text fields including title, subtitle, body, and bullets are directly interpolated into the template as raw HTML, making the generated output susceptible to XSS.
[COMMAND_EXECUTION]: The scripts/export-slides.js script uses Playwright to automate a Chromium instance. The browser navigates to local files using the file:// protocol, which represents a potential risk if the generated HTML content is malicious and targets the local filesystem.

presentation-generator