The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill fetches font metadata, CSS, and binary font files from official Google Fonts domains (fonts.google.com, fonts.googleapis.com, fonts.gstatic.com) and its public GitHub repository (raw.githubusercontent.com/google/fonts). This is a legitimate functional requirement for the skill's typography generation capabilities and targets well-known services.
[INDIRECT_PROMPT_INJECTION]: The skill inherently processes untrusted data from user-supplied images and documents, as well as external web research results. This attack surface is mitigated by an extensive 25-step verification process.
Ingestion points: User-supplied multimodal sources enter the agent context in Step 02 (references/execution-intake.md) and external research records enter in Step 08 (references/execution-intake.md).
Boundary markers: The skill requires the agent to explicitly classify all findings as observed, inferred, or assumed in Step 05 (references/execution-intake.md), preventing accidental obedience to instructions embedded in input data. It also employs SHA-256 hashing to freeze the state of all inputs.
Capability inventory: The skill produces structured JSON tokens and a self-contained HTML proof. It executes several internal scripts for validation and hashing via subprocess (scripts/run_pipeline.py).
Sanitization: The output is validated against the DTCG 2025.10 JSON schema, and the HTML proof artifact uses a strictly defined placeholder substitution method (scripts/assemble_artifact.py) that identifies and prohibits external assets.

dtcg-tokens