The Agent Skills Directory

[COMMAND_EXECUTION]: The skill utilizes shell scripts (scripts/new-deck.sh and scripts/render.sh) to scaffold new presentation projects and render them into static images using Headless Chrome. These scripts are intended to be executed locally within the agent's environment.
[EXTERNAL_DOWNLOADS]: Templates provided by the skill reference external resources from well-known services, including Google Fonts (fonts.googleapis.com), Cloudflare cdnjs (cdnjs.cloudflare.com for highlight.js), and JSDelivr (cdn.jsdelivr.net for Chart.js). These are used to provide typography, code syntax highlighting, and charting functionality.
[INDIRECT_PROMPT_INJECTION]: The process of generating and rendering presentations creates a potential surface for indirect prompt injection.
Ingestion points: The skill takes arbitrary user input to populate slide content, titles, and code blocks within the HTML templates.
Boundary markers: The templates do not employ explicit boundary markers or instructions to the agent to ignore potentially malicious embedded content in the user data.
Capability inventory: The render.sh script executes a headless browser instance to process the resulting HTML/JS, which involves executing JavaScript in a browser environment.
Sanitization: The skill does not demonstrate automated sanitization or escaping of user-provided content before it is interpolated into the HTML structure, which could allow malicious scripts in user content to execute during the rendering process.
[DYNAMIC_EXECUTION]: The fx-runtime.js component dynamically initializes canvas effects by loading and executing local JavaScript modules from the assets/animations/fx/ directory based on the data-fx attribute found on slide elements.

html-ppt-skill