The Agent Skills Directory

[COMMAND_EXECUTION]: The script scripts/html_render.py executes a Chromium-family browser (such as Chrome or Edge) in headless mode using subprocess.run to render HTML templates into PNG images. The command is constructed as a list of arguments, and the browser is directed to open a local temporary file containing the rendered template.
[EXTERNAL_DOWNLOADS]: The skill downloads font files from remote URLs in scripts/pillow_render.py. This includes fetching assets from Google Fonts and user-provided HTTPS URLs. These downloads are a standard part of the skill's functionality to ensure correct typography.
[DYNAMIC_EXECUTION]: The skill utilizes a headless browser to render HTML and CSS content. This process involves executing web content, including an internal JavaScript snippet in scripts/html_render.py used to measure text height for the 'shrink' overflow mode.
[INDIRECT_PROMPT_INJECTION]: The skill processes JSON payloads that contain templates and variables, creating an attack surface if the input data is sourced from an untrusted external party.
Ingestion points: Payloads are read from JSON files specified via the CLI in scripts/overlay.py.
Boundary markers: No specific boundary markers are employed to isolate variable content from the rest of the template.
Capability inventory: Includes execution of local browser binaries via subprocess, network requests for font assets, and writing output files to the filesystem.
Sanitization: Standard Mustache escaping is used, and html.escape is applied to text layers; however, rich layers allow raw HTML interpolation by design to support complex layouts.

scenario-text-overlay