The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill fetches KaTeX CSS and JavaScript assets from the well-known cdn.jsdelivr.net CDN. This occurs in main.py when local versions of the library are not detected in the environment. This is standard behavior for including open-source libraries in web-based projects.
[COMMAND_EXECUTION]: The scripts/install.sh file executes standard shell commands to install dependencies listed in requirements.txt. It includes a check for externally managed environments and may use the --break-system-packages flag, which is a common (though aggressive) method for ensuring Python packages are installed on newer Linux distributions.
[INDIRECT_PROMPT_INJECTION]: The skill processes JSON data generated by external AI models. While main.py includes a formatAnswerForExam function that performs basic HTML escaping (e.g., for <, >, and &), the resulting HTML is rendered using innerHTML. This creates a theoretical surface for DOM-based XSS if a user processes a JSON file containing malicious scripts. However, since the output is a local HTML file intended for the user's personal study environment, the risk is negligible.
Ingestion points: convert_json_to_flashcards reads a user-specified JSON file.
Boundary markers: The data is expected in a structured JSON schema, providing natural separation from instructions.
Capability inventory: The skill writes a single local HTML file and optionally exports a CSV; no network exfiltration or system modification capabilities are present in the core script.
Sanitization: The script performs basic escaping of HTML special characters within the formatAnswerForExam JavaScript function inside the generated HTML.

flashcards