The Agent Skills Directory

[OBFUSCATION]: The file demo/index.html contains a large Base64-encoded string (encodedHtml) which encapsulates a complete HTML document including initialization logic. This method of encoding hides the code from static inspection and manual review.
[DYNAMIC_EXECUTION]: The skill dynamically decodes the encodedHtml string using atob and TextDecoder, then executes it by assigning the result to the srcdoc attribute of an iframe at runtime.
[INDIRECT_PROMPT_INJECTION]: The skill's primary function is to transform user-provided project briefs and concept anchors into complex UI layouts. This creates an attack surface for indirect prompt injection where malicious instructions embedded in a project brief could influence the generated output or agent behavior.
Ingestion points: Product brief anchors and descriptions in demo/PROMPT.md.
Boundary markers: None identified in the prompt interpolation logic.
Capability inventory: The skill generates interactive HTML, CSS, and JavaScript with WebGL components (Three.js) and animation libraries (GSAP).
Sanitization: No sanitization or validation of the input brief content is performed before processing.
[EXTERNAL_DOWNLOADS]: The demo environment references external libraries and assets from well-known technology services and trusted providers.
Fetches image assets from Supabase storage (hoirqrkdgbmvpwutwuwj.supabase.co), which is a recognized trusted vendor.
Loads runtime dependencies from Google Fonts, Cloudflare CDN, and Tailwind CDN, all of which are recognized well-known services.

book-serif-index