The Agent Skills Directory

[OBFUSCATION]: The file demo/index.html contains a large Base64-encoded string assigned to the variable encodedHtml. This string encodes the full HTML, CSS, and JavaScript content of the skill's demonstration page, hiding the implementation from static analysis.
[DYNAMIC_EXECUTION]: The skill employs dynamic code execution by decoding the encodedHtml Base64 string at runtime and injecting it into an iframe's srcdoc attribute. This allows for the execution of JavaScript within the sandboxed demo environment.
[EXTERNAL_DOWNLOADS]: The skill and its demo reference multiple external resources from well-known technology companies and cloud services. These include:
Google Fonts (fonts.googleapis.com, fonts.gstatic.com) for typography.
Fontshare (api.fontshare.com) for supplemental font assets.
Cloudflare's public CDN for GSAP and Three.js animation and rendering libraries (cdnjs.cloudflare.com).
Iconify's official domain for UI icons (code.iconify.design).
Tailwind CSS's official content delivery network (cdn.tailwindcss.com).
Supabase storage for image assets (hoirqrkdgbmvpwutwuwj.supabase.co).
[INDIRECT_PROMPT_INJECTION]: The skill exhibits an indirect prompt injection vulnerability surface as it processes external data (such as the product briefs and content anchors described in demo/PROMPT.md) and interpolates it into a generated WebGL-heavy HTML environment.
Ingestion points: Content anchors, subject tags, and brand descriptions provided in demo/PROMPT.md are integrated into the final design.
Boundary markers: Absent; the data is placed directly into the HTML structure of the generated document.
Capability inventory: The skill has the ability to generate and execute JavaScript (via Three.js and GSAP) and manipulate the DOM based on these inputs.
Sanitization: The provided templates do not show explicit sanitization or escaping of the interpolated strings.

corner-lasers