The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill references Google Fonts and Phosphor Icons (via JSDelivr) in its templates and documentation. These are well-known and established services for web development.
[COMMAND_EXECUTION]: The skill provides a Python script (scripts/init_project.py) to scaffold new projects. This script performs file system operations (creating directories and writing files) based on user-provided arguments. It includes basic path traversal protection to ensure files are only created within the designated project folder.
[DATA_EXPOSURE]: No evidence of sensitive data access or exfiltration. The skill uses client-side sessionStorage for basic state management (audio playback and a courtesy auth gate), which is standard practice for static sites.
[PROMPT_INJECTION]: No prompt injection or behavior override patterns were found in the skill instructions or metadata.
[CREDENTIALS_UNSAFE]: No hardcoded credentials or secrets are present. The 'auth gate' uses a simple FNV-1a hash, but it is explicitly documented as a courtesy visibility gate for non-public docs rather than a robust security mechanism.

vellum-editorial