The Agent Skills Directory

[DYNAMIC_EXECUTION]: The skill documents that the full build of lottie-web includes an expression engine that runs After Effects expressions using eval(). This presents a risk when loading animation files from untrusted or user-provided sources. The skill mitigates this by recommending the lottie_light build, which excludes the expression engine and eval() usage.
[EXTERNAL_DOWNLOADS]: The skill references and provides instructions for installing well-known and trusted packages: lottie-web (Airbnb) and @lottiefiles/dotlottie-web. These are standard industry tools for vector animations. It also mentions that the dotLottie player fetches WebAssembly (WASM) components from the jsDelivr CDN by default.
[INDIRECT_PROMPT_INJECTION]: The skill defines a surface for processing untrusted data via the animationData prop in the LottiePlayer React component and the path parameter in playFromUrl. While Lottie JSON files are data-driven, the inclusion of an expression engine creates a path for script injection if the source is malicious. The documentation includes guidelines to use the light build for third-party files to neutralize this vector.
[COMMAND_EXECUTION]: The skill includes standard npm install commands for package management, which is expected for a developer-oriented skill.

lottie