The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes user-supplied information (such as professional history for resumes or company details for one-pagers) and interpolates it directly into HTML templates. This represents a potential surface for indirect prompt injection if the resulting document is rendered in an environment that executes scripts or styles without proper sanitization.
Ingestion points: User prompts containing text for resumes, slide decks, white papers, and letters (SKILL.md).
Boundary markers: None specified for user-provided document content.
Capability inventory: The skill generates complex self-contained HTML and SVG content and suggests rendering workflows using Puppeteer or WeasyPrint (SKILL.md).
Sanitization: No explicit sanitization or escaping instructions are provided for the agent to apply to user content before embedding it in the HTML structure.
[EXTERNAL_DOWNLOADS]: The skill provides installation commands that download content from GitHub repositories and third-party registries. It also recommends installing external PDF rendering tools.
Evidence:
Installation via npx skills add tw93/kami fetches code from external sources.
Instructions for pip install weasyprint and require('puppeteer') involve downloading external packages.
Release assets are linked to github.com/tw93/kami/releases.

kami-document-design