The Agent Skills Directory

[COMMAND_EXECUTION]: The skill executes shell commands to support its workflow:
Uses curl to verify that CDN URLs from the library catalog are valid and reachable before using them in generated code.
Executes a Node.js validation script (validate-visuals-playwright.mjs) to automate the screenshot capture and visual review process.- [EXTERNAL_DOWNLOADS]: The skill fetches and utilizes various third-party libraries for visualization and animation:
References official CDN URLs for libraries such as D3.js, Chart.js, Three.js, and GSAP.
Sources include well-known and reputable providers like cdnjs (Cloudflare), jsdelivr, and unpkg.- [REMOTE_CODE_EXECUTION]: The core functionality involves generating and then executing arbitrary HTML, CSS, and Javascript:
Generated showcase pages are loaded into a headless Chromium browser using Playwright for validation purposes in scripts/validate-visuals-playwright.mjs.
This workflow creates an indirect prompt injection surface where untrusted data inputs (such as mockData, sceneDescription, or styleDirection defined in SKILL.md) are interpolated into generated code that is subsequently executed.
Ingestion points: Inputs like mockData, libraryDirective, and sceneDescription enter the agent context.
Boundary markers: None identified in the provided instructions to delimit untrusted data during code generation.
Capability inventory: The skill uses Playwright to execute generated content and curl to probe network resources.
Sanitization: There are no instructions for sanitizing or escaping the external content before it is interpolated into the HTML/JS output.

visual-creative-subagent