The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill ingests user-provided content, design descriptions, and URLs to generate code. This creates a potential surface for indirect prompt injection where untrusted data is incorporated into the generated HTML/JS. However, the skill provides explicit instructions to minimize complexity and avoid dangerous functions.
[SAFE]: The skill includes several high-quality security constraints in its 'What NOT to Include' and 'Build Rules' sections:
Prohibits all external JavaScript libraries and remote font imports.
Explicitly forbids network operations, including fetch calls and API requests.
Disallows persistence mechanisms such as localStorage or sessionStorage.
Requires JavaScript to be scoped within an Immediately Invoked Function Expression (IIFE) to prevent global namespace pollution.
Enforces local icons via inline SVG rather than external icon fonts.

just-html