The Agent Skills Directory

[OBFUSCATION]: The file demo/index.html contains a large Base64-encoded string (encodedHtml) that decodes to a full HTML document including inline JavaScript. While used here as a sandboxing mechanism for demo content, encoding executable content is a technique often used to hide malicious behavior from static analysis.
[INDIRECT_PROMPT_INJECTION]: The skill is designed to generate UI code by analyzing external references, creating a potential attack surface where instructions embedded in reference data could influence the agent.
Ingestion points: The agent is instructed in demo/PROMPT.md to use demo/index.html and the external URL https://neuform.ai/pages/freelance-designer-growth-partner/index.html as visual and functional references.
Boundary markers: There are no explicit instructions or delimiters used to ensure the agent ignores potential commands embedded within these reference materials.
Capability inventory: The skill allows the agent to generate complex HTML, CSS, and JavaScript structures, including animations (GSAP) and external library integrations.
Sanitization: The skill does not implement any validation or sanitization of the content fetched from the reference sources before using it to inform code generation.
[EXTERNAL_DOWNLOADS]: The demo environment loads runtime dependencies from well-known and trusted Content Delivery Networks (CDNs).
Evidence: The demo/source.json and demo/index.html files reference cdnjs.cloudflare.com (GSAP), cdn.tailwindcss.com (Tailwind), and code.iconify.design (Iconify). These are recognized as safe, well-known services for web development.

agency-grid-layout-minimal