The Agent Skills Directory

[OBFUSCATION]: The demo environment in demo/index.html uses a large Base64-encoded string (encodedHtml) to bundle the demo's HTML document. This is a common packaging method for sandboxed examples and does not contain malicious logic.
[EXTERNAL_DOWNLOADS]: The demo/source.json file identifies external assets and dependencies fetched from trusted or well-known services, including Cloudflare's CDN for GSAP and Iconify libraries, and Supabase for media storage. These resources are standard for modern web development and represent legitimate vendor functionality.
[DYNAMIC_EXECUTION]: demo/index.html dynamically decodes the bundled content and injects it into an iframe via the srcdoc attribute. It also performs runtime path resolution to link external scripts.
[INDIRECT_PROMPT_INJECTION]: The skill processes user-supplied product briefs and external design references in demo/PROMPT.md, representing a potential injection surface.
Ingestion points: Ingests product descriptions and visual reference URLs from the user.
Boundary markers: None present.
Capability inventory: Limited to HTML/CSS generation and local file reading for the demo sandbox.
Sanitization: None observed; relies on platform-level model guardrails.

marquee-loop