The Agent Skills Directory

[OBFUSCATION]: The demo implementation in demo/index.html encapsulates an entire HTML document and its associated scripts within a large Base64-encoded string (encodedHtml). This technique obscures the actual page structure and behavior from static analysis.
[DYNAMIC_EXECUTION]: The skill performs runtime decoding of the encodedHtml variable in demo/index.html and dynamically populates the srcdoc attribute of an iframe. This allows the execution of arbitrary scripts and HTML content that is not visible in the plain text of the file.
[EXTERNAL_DOWNLOADS]: The demo references and loads resources from established external services, including typography from Google Fonts (fonts.googleapis.com, fonts.gstatic.com) and Fontshare (api.fontshare.com). It also utilizes established libraries for animation and icons through Cloudflare's CDN (GSAP, Three.js) and the official Iconify domain.
[INDIRECT_PROMPT_INJECTION]: The skill possesses an attack surface for indirect prompt injection by processing external assets and dynamically generated content.
Ingestion points: The skill dynamically fetches asset files and processes complex HTML payloads through demo/index.html.
Boundary markers: The demo is restricted within an iframe using sandbox="allow-scripts" to isolate its execution.
Capability inventory: The implementation uses fetch to load resources and postMessage to communicate data between the host environment and the sandboxed demo.
Sanitization: Content is isolated within a sandboxed srcdoc environment, which helps mitigate potential risks from the processed data.

company-logos