The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill facilitates the conversion of external web pages and Figma designs into interactive slideshows. This processing of untrusted third-party data represents an attack surface for indirect prompt injection, where malicious instructions within the source content could attempt to manipulate the agent's behavior during the conversion process.
Ingestion points: The skill ingest data from Figma URLs and arbitrary source pages provided by the user for conversion into decks.
Boundary markers: While the skill mentions SVG sanitization, it does not specify the use of clear boundary markers or instructions to the agent to ignore embedded prompts in the source data.
Capability inventory: The skill has access to shell commands via npx, including the ability to add new blocks/components (npx hyperframes add) and update the skill itself (npx hyperframes skills update).
Sanitization: The skill documentation mentions that the /figma command handles SVG sanitization and brand-token binding.
[EXTERNAL_DOWNLOADS]: The skill uses external resources from well-known services for its operation.
It imports the Three.js library from cdn.jsdelivr.net for 3D visual effects in the presentations.
It uses npx to fetch components from the hyperframes registry and to update its own capabilities.
[COMMAND_EXECUTION]: The skill provides instructions for the agent to run various CLI commands as part of the authoring workflow.
Commands include npx hyperframes skills update, npx hyperframes catalog, npx hyperframes add, npx hyperframes present, npx hyperframes render, and npx hyperframes check. These are standard tools for the platform's development environment.

slideshow