The Agent Skills Directory

[OBFUSCATION]: The file demo/index.html contains a large Base64-encoded string (encodedHtml) which decodes to a legitimate HTML document containing UI logic. This is used for bundling a sandboxed demo into a single file and does not hide malicious intent.
[EXTERNAL_DOWNLOADS]: The skill references several external runtime libraries and assets in demo/source.json and demo/index.html. These include libraries like GSAP, Three.js, and Iconify, as well as Google Fonts, all hosted on well-known and trusted CDNs (Cloudflare, Google, Tailwind). These are standard dependencies for the described design functionality.
[INDIRECT_PROMPT_INJECTION]: The demo prompts in demo/PROMPT.md instruct the AI agent to use the provided demo/index.html as a visual and interaction reference. This represents an attack surface where an attacker could place malicious instructions; however, the provided demo content is strictly related to the design system and contains no such instructions.
[COMMAND_EXECUTION]: The skill describes visual styles and interaction logic using standard web technologies. No shell commands or system-level executions are present in the skill instructions or scripts.

editorial-tech