The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted user data (event titles, descriptions, and notes) and interpolates it into generated HTML and JSON files.
Ingestion points: User-provided event details collected in Step 1 of the skill workflow.
Boundary markers: There are no explicit instructions or delimiters used to separate user-provided data from the structure of the generated code.
Capability inventory: The skill writes multiple files to the local directory, including HTML and JSON data files.
Sanitization: The generated main.html uses .innerHTML to render event headlines and descriptions from the JSON data. This creates a Cross-Site Scripting (XSS) surface where malicious HTML in the user input would be executed when the timeline is viewed.
[EXTERNAL_DOWNLOADS]: The generated visualization fetches the vis-timeline library from a well-known public CDN.
Source: https://cdnjs.cloudflare.com/ajax/libs/vis-timeline/7.7.3/vis-timeline-graph2d.min.js and corresponding CSS.
Context: This is a standard implementation for loading a common visualization library from a reputable content delivery network.
[DYNAMIC_EXECUTION]: The skill generates a complete interactive web application from templates at runtime.
The template-main.html uses placeholder substitution to assemble the final application logic.
The generated application performs client-side data loading via fetch() and executes rendering logic based on the contents of a generated JSON file.

timeline-generator