The Agent Skills Directory

[DYNAMIC_EXECUTION]: The skill describes the use of the pea.runScript() method, which executes JavaScript strings within the Photopea environment. This involves the runtime generation and execution of code strings to perform image manipulation tasks.
[INDIRECT_PROMPT_INJECTION]: The skill provides an API surface for processing external data (such as remote URLs and file inputs) that can be manipulated via scripting. This creates a potential surface for indirect injection if an agent interpolates untrusted data into scripts without proper sanitization. 1. Ingestion points: The methods pea.runScript, pea.openFromURL, and pea.loadAsset in SKILL.md are documented to handle external content. 2. Boundary markers: Not strictly enforced in the skill instructions, though remediation is advised in the text. 3. Capability inventory: The API allows for document manipulation, file export through exportImage or saveToOE, and fetching remote resources. 4. Sanitization: The documentation explicitly recommends using JSON.stringify to sanitize dynamic values before they are used in scripts.
[EXTERNAL_DOWNLOADS]: The skill references the installation of the photopea package from the npm registry and the inclusion of the library from the cdn.jsdelivr.net content delivery network. These references target well-known public infrastructure.

photopea-embedded-editor