The Agent Skills Directory

[COMMAND_EXECUTION]: The skill invokes local Python scripts and standard development tools to perform technical tasks.
Evidence: scripts/verify.py is executed to run integrity gates, color analysis, and layout verification.
Evidence: SKILL.md instructs the execution of npx @google/design.md lint to validate generated design tokens.
Evidence: playwright install chromium is referenced for PDF rendering capabilities.
[EXTERNAL_DOWNLOADS]: The skill utilizes external dependencies and well-known services to fulfill its branding deliverables.
Evidence: Fetches a linter from Google's official NPM package registry.
Evidence: Downloads the Chromium browser engine via the Playwright library for automated document rendering.
Evidence: References Google Fonts (fonts.googleapis.com) in HTML templates for brand typography.
[PROMPT_INJECTION]: The skill's surface for indirect prompt injection was evaluated because it processes untrusted user descriptions (business overviews, vision statements).
Ingestion points: SKILL.md Phase 1 (Gather Inputs) collects business descriptions and mission statements.
Boundary markers: Implicit boundaries are defined by the structured workshop phases, though explicit "ignore instruction" delimiters are not present for the initial intake.
Capability inventory: The skill can write files, execute subprocesses (scripts/verify.py), and interact with external tools (Hugging Face).
Sanitization: SKILL.md (Mascot Lane, Step 6) contains explicit instructions to "HTML-escape every scalar copy token before replacing" to prevent cross-site scripting or structural breakage in generated HTML assets.

brand-workshop