The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill references Google Fonts services (fonts.googleapis.com and fonts.gstatic.com) within references/html-scaffold.md to load stylesheets and preconnect to font resources for document styling. These are recognized well-known services.
[DATA_EXFILTRATION]: Instructions in references/html-scaffold.md direct the agent to read SVG logo files from a vendor-specific configuration directory at ~/.octave/brands/ to inline them into generated reports. This represents access to local assets belonging to the skill's authoring organization.
[INDIRECT_PROMPT_INJECTION]: The skill populates a self-contained HTML scaffold with data retrieved from external account records and evidence inputs, creating a surface for indirect prompt injection. 1. Ingestion points: Data is ingested from external files including evidence-and-inputs.md and gtm-context.md as specified in references/task-method.md. 2. Boundary markers: The instructions lack specific delimiters or warnings to the agent for handling untrusted content during interpolation. 3. Capability inventory: The skill generates HTML artifacts with embedded JavaScript logic for navigation and UI features. 4. Sanitization: No explicit sanitization or escaping protocols are provided in the task method or templates to prevent malicious content in the source data from injecting script or styling into the generated documents.

meeting-prep