The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill fetches machine learning models, configuration files, and tokenizer data from Hugging Face Hub.
Evidence: Mentions huggingface.co as the primary source for model resolution in SKILL.md and references/CONFIGURATION.md.
[EXTERNAL_DOWNLOADS]: The skill downloads library scripts and ONNX Runtime WebAssembly binaries from the JSDelivr CDN to facilitate model inference.
Evidence: References to https://cdn.jsdelivr.net/npm/@huggingface/transformers in browser usage examples.
[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted external data, such as text, images, and audio, as inputs to machine learning models, representing a typical integration attack surface.
Ingestion points: Data inputs provided to the pipeline() tasks throughout the documentation, including user-provided text, remote image URLs, and audio blobs.
Boundary markers: None; the skill acts as a direct wrapper for model inference without implementing its own prompt delimiters or guardrails.
Capability inventory: File system access for model caching (Node.js), network operations for acquiring model assets, and CPU/GPU-based inference execution.
Sanitization: No input validation or output filtering is performed by the skill itself; safety depends on the underlying model and implementation.
[DYNAMIC_EXECUTION]: The skill dynamically loads and executes WebAssembly (WASM) binaries to provide the execution backend for model inference across different JavaScript runtimes.
Evidence: Documentation in references/CONFIGURATION.md describes configuring wasmPaths to load .wasm files like ort-wasm.wasm from CDNs or local storage.

transformers-js