The Agent Skills Directory

[OBFUSCATION]: The file demo/index.html contains a large Base64-encoded string (encodedHtml) that encapsulates the primary application logic, HTML structure, and style definitions, preventing straightforward security review of the demo's behavior.
[DYNAMIC_EXECUTION]: The demo environment uses runtime scripts to decode content and manage asset loading.
A script in demo/index.html decodes the encodedHtml string and dynamically sets it as the source for a sandboxed iframe using srcdoc.
The skill uses URL.createObjectURL to dynamically convert binary asset data into local URLs at runtime, which are then injected into the iframe's context.
[INDIRECT_PROMPT_INJECTION]: The design instructions in demo/PROMPT.md rely on external references, creating a vulnerability to indirect prompt injection.
Ingestion points: The skill directs the agent to analyze external design snapshots and visual references at neuform.ai (identified in demo/PROMPT.md).
Boundary markers: No delimiters or safety instructions are provided to distinguish between valid design references and potentially malicious instructions within those external sources.
Capability inventory: The skill facilitates the generation of complex frontend code (HTML/JS), which can be manipulated by untrusted external data.
Sanitization: The skill does not implement validation or sanitization for the external content it processes.
[EXTERNAL_DOWNLOADS]: The demonstration references several external dependencies from well-known services.
Fetches runtime libraries including GSAP and Three.js from Cloudflare's cdnjs.
Downloads iconography from the official Iconify CDN.
Loads styles and runtime logic from Tailwind's official CDN.
Retrieves typography from Google Fonts.

beautiful-shadows