The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill automates the retrieval of external resources from public registries.
scripts/package-loader.mjs uses npm install to download Node.js packages during execution.
references/typography.md suggests a workflow that uses curl to fetch font metadata from Google Fonts.
[REMOTE_CODE_EXECUTION]: The script scripts/package-loader.mjs provides a mechanism to install and immediately execute code from the npm registry if a specific environment variable is set or via interactive terminal prompts.
[COMMAND_EXECUTION]: The skill executes shell commands to process media assets.
scripts/extract-audio-data.py uses the subprocess module to call ffmpeg for audio decoding.
references/design-picker.md instructs the agent to launch a local server using python3 -m http.server to host interactive design previews.
[DYNAMIC_EXECUTION]: The skill employs dynamic loading patterns.
scripts/package-loader.mjs dynamically imports modules from temporary directories created during the bootstrap process.
scripts/contrast-report.mjs executes code within a browser context (Puppeteer) to analyze the DOM of project-specific HTML files.
[INDIRECT_PROMPT_INJECTION]: The skill has a significant vulnerability surface for indirect injection by processing untrusted data.
Ingestion points: scripts/contrast-report.mjs reads and executes logic against user-provided index.html files. references/design-picker.md generates complex HTML previews from user-supplied prompt contexts.
Boundary markers: Absent; the scripts process file content directly without delimiters or instruction-bypass warnings.
Capability inventory: The skill can execute shell commands, download packages, and start network servers.
Sanitization: While package-loader.mjs uses a basic shell-quoting regex, the HTML generation in the design picker relies on innerHTML and simple warnings to the user to avoid malicious tags.

hyperframes-creative