The Agent Skills Directory

[COMMAND_EXECUTION]: The skill instructs the agent to execute local utility scripts (scripts/inspect-assets.py and scripts/validate-layers.js) using Python and Node.js. These tools are used to analyze user-provided image assets and validate the resulting HTML structure for performance and accessibility.
[EXTERNAL_DOWNLOADS]: The skill incorporates the GSAP (GreenSock Animation Platform) library via the jsDelivr CDN (cdn.jsdelivr.net). jsDelivr is a well-known and trusted service for delivering front-end assets, and GSAP is a standard industry library for high-performance animations.
[INDIRECT_PROMPT_INJECTION]: The skill has an inherent attack surface for indirect prompt injection as it is designed to ingest and act upon untrusted user-provided data.
Ingestion points: The agent processes external image assets and project context descriptions which could potentially contain embedded instructions or malicious content.
Boundary markers: No explicit delimiters or specialized instructions to ignore embedded content within processed assets are mentioned in the skill definition.
Capability inventory: The skill possesses the capability to execute local scripts for analysis and generate complex client-side JavaScript for DOM manipulation and Canvas-based animations.
Sanitization: The TextScramble class example provided in micro-interactions.md utilizes innerHTML to render text. This approach lacks sanitization and could lead to cross-site scripting (XSS) if the input text provided to the effect contains malicious HTML tags.

epic-design