The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill acts as a surface for processing untrusted user data into executable code.
Ingestion points: Requirement descriptions and data samples (records) provided by the user enter the agent's context and are interpolated into generated script files (spec.js, config.js).
Boundary markers: The instructions in SKILL.md direct the agent to use user-provided data and avoid hallucinations, but no explicit structural delimiters are mandated for the prompts.
Capability inventory: The skill uses Python scripts (scripts/generate_demo_html.py and scripts/generate_diagnosis_html.py) that write generated code to the local file system.
Sanitization: The Python generation scripts apply JS string escaping (escape_js_string), and the resulting HTML reports include a sanitizeCode function that removes imports/exports before execution.
[DYNAMIC_EXECUTION]: The skill facilitates the execution of generated JavaScript code within a browser context.
Evidence: The templates in template/demo.html and template/diagnosis.html utilize new Function() to run the code provided via spec.js or config.js.
Context: This dynamic execution is a core feature of the skill, providing an interactive live-preview for developers to test VTable configurations. The execution is restricted to the browser environment of the generated report.

vtable-skill