The Agent Skills Directory

[OBFUSCATION]: The demo/index.html file contains a large Base64-encoded string (encodedHtml) that stores the complete source code for a design demonstration. This content is decoded at runtime to be displayed within a sandboxed iframe. While this encoding hides the implementation details from plain-text scanners, it is a technical mechanism used for providing a self-contained preview environment and does not appear to conceal malicious logic.
[EXTERNAL_DOWNLOADS]: The skill's demo environment references external JavaScript and CSS resources from well-known and trusted services, including Google Fonts (fonts.googleapis.com), Tailwind CSS (cdn.tailwindcss.com), Cloudflare (cdnjs.cloudflare.com), and Iconify (code.iconify.design). These are standard dependencies for modern web design and are recognized as safe sources.
[INDIRECT_PROMPT_INJECTION]: The skill is intended to generate UI code based on user-provided design requirements (as shown in demo/PROMPT.md). This creates a surface for potential indirect prompt injection if the agent processes untrusted external data to generate the UI. However, the provided demo environment mitigates this risk by using an iframe with a restrictive Content Security Policy (CSP) and the sandbox="allow-scripts" attribute, ensuring that generated code execution is isolated.
[SAFE]: No malicious patterns, persistence mechanisms, or unauthorized privilege escalation attempts were detected. The skill's behavior matches its stated purpose of defining a visual design system.

orange-clean-paper-saas