The Agent Skills Directory

[PROMPT_INJECTION]: The skill exhibits a surface for indirect prompt injection where untrusted user content (pitch stories and slide lists) is interpolated into generated HTML and JavaScript code.
Ingestion points: User-provided pitch stories and slide lists processed in Step 1 and Step 2 of SKILL.md.
Boundary markers: None identified; user content is placed directly into HTML headers and body text.
Capability inventory: The skill generates an HTML/JS file that executes in a browser environment, and provides a Python driver snippet that executes JavaScript via a separate recording skill (demo-video).
Sanitization: The skill instructions in references/deck-patterns.md do not explicitly mandate escaping or sanitizing user-provided text before inserting it into the HTML skeleton.
[COMMAND_EXECUTION]: The skill instructs the user or agent to execute standard developer commands for local development and media processing.
Evidence: SKILL.md and references/deck-recording.md describe using python3 -m http.server for local testing and ffmpeg for stitching recorded video parts.
[EXTERNAL_DOWNLOADS]: The skill provides patterns for embedding external media into the deck.
Evidence: references/deck-patterns.md includes a template for embedding a YouTube video using youtube-nocookie.com. This is a well-known service and is documented here for completeness.

pitch-deck