The Agent Skills Directory

[COMMAND_EXECUTION]: The skill instructs the agent to execute local scripts scripts/check_contrast.py and scripts/render_xhs.mjs using python3 and node to validate design tokens and render the final HTML output for user review.- [DYNAMIC_EXECUTION]: The script scripts/render_xhs.mjs performs dynamic module loading by searching for the playwright package across multiple computed file system paths, including the user's home directory and specific environment cache folders.- [INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted user content and interpolates it into HTML templates which are then rendered by a headless browser instance. This creates a surface where malicious scripts embedded in the user content could potentially execute within the rendering context.
Ingestion points: User-provided articles, notes, and documents in SKILL.md.
Boundary markers: No explicit sanitization or boundary markers are defined to handle HTML entities in the generated output.
Capability inventory: The skill utilizes node to run playwright, which launches a Chromium browser instance.
Sanitization: No explicit sanitization or escaping logic was found for user-injected text in the HTML generation phase.

xhs-html