The Agent Skills Directory

[COMMAND_EXECUTION]: The script scripts/render_png.py executes shell commands via subprocess.run to manage its environment and perform rendering tasks.
Evidence includes the installation of the playwright library and the execution of the wkhtmltoimage utility for PNG export.
[EXTERNAL_DOWNLOADS]: The skill retrieves image assets and metadata from pexels.com and unsplash.com. It also performs dynamic installation of the playwright package and its associated Chromium browser binaries from official registries.
[INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data from external websites (image captions and descriptions), creating an indirect prompt injection surface.
Ingestion points: External image data is fetched from Pexels and Unsplash through web_fetch commands as outlined in SKILL.md.
Boundary markers: The skill relies on structured JSON manifests for internal data handling, although it does not provide explicit instructions for the model to disregard embedded instructions within the processed data.
Capability inventory: The skill possesses file-writing capabilities (HTML/PNG), network access for fetching assets, and command execution for rendering.
Sanitization: The scripts/build_html_moodboard.py utility uses html.escape to sanitize all external inputs—including titles, subtitles, image URLs, alt text, and palette names—before they are embedded in the final HTML output.

moodboard-generator