The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes user-supplied pitch outlines and integrates external hyperlinks for data citations into the generated HTML deck.
Ingestion points: User pitch story instructions in SKILL.md and external citation URLs in references/deck-patterns.md.
Boundary markers: The generated HTML template lacks explicit delimiters or instructions to ignore embedded commands within user-provided content.
Capability inventory: The skill generates HTML/JavaScript files and interfaces with a recording harness (managed by the separate demo-video skill) capable of executing browser-side JavaScript.
Sanitization: There is no evidence of explicit sanitization or escaping logic for user-provided text or citation links before they are embedded in the HTML output.- [DYNAMIC_EXECUTION]: The skill generates executable JavaScript code within the HTML deck for navigation and provides code snippets for automated recording tasks.
Evidence: references/deck-patterns.md includes inline <script> blocks for slide logic (hash-based navigation), and references/deck-recording.md defines a BEATS array containing JavaScript strings like document.getElementById('next').click() intended for execution via a browser automation harness.

pitch-deck