The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill references the photopea package from the npm registry and provides a CDN link for direct inclusion of the library (https://cdn.jsdelivr.net/npm/photopea@1.1.1/dist/photopea.min.js). These references use well-known services and are appropriate for the skill's purpose.
[DYNAMIC_EXECUTION]: The documentation describes using pea.runScript() to execute JavaScript code within the sandboxed Photopea editor context. To mitigate security risks, the guide includes specific best practices, advising developers to avoid direct string concatenation and to use JSON.stringify for dynamic parameter serialization.
[INDIRECT_PROMPT_INJECTION]: The skill defines an attack surface by allowing the editor to process external image assets and remote URLs. 1. Ingestion points: Content is loaded via pea.openFromURL, pea.loadAsset, and app.open(url). 2. Boundary markers: The documentation provides explicit warnings against insecure interpolation of user data into scripts. 3. Capability inventory: The API enables image processing, network requests for assets, and file generation. 4. Sanitization: The author provides remediation steps by recommending proper serialization of all dynamic inputs.

photopea-embedded-editor