The Agent Skills Directory

[OBFUSCATION]: The file demo/index.html contains a large Base64-encoded string assigned to the variable encodedHtml. This string encodes the entire demonstration webpage, including its HTML structure, CSS styles, and embedded JavaScript logic, effectively hiding the demo's code from static analysis.
[DYNAMIC_EXECUTION]: The demonstration harness in demo/index.html decodes the encodedHtml string at runtime and injects the result into an iframe's srcdoc attribute. This process dynamically assembles and executes executable content based on the obfuscated payload.
[EXTERNAL_DOWNLOADS]: The skill and its demonstration environment reference several external resources from well-known services:
Fetches configuration and media assets from a Supabase storage bucket (hoirqrkdgbmvpwutwuwj.supabase.co).
Loads runtime scripts and styles from established CDNs including Cloudflare (GSAP), Iconify, and Tailwind CSS.
Downloads font configurations from Google Fonts and Fontshare.
[INDIRECT_PROMPT_INJECTION]: The instructions in demo/PROMPT.md describe a surface for indirect prompt injection by directing the agent to ingest external design references and content anchors for code generation.
Ingestion points: Reference URLs (e.g., neuform.ai) and user-provided product briefs in demo/PROMPT.md.
Boundary markers: No explicit instructions or delimiters are provided to prevent the agent from following embedded instructions in external data.
Capability inventory: The skill environment supports DOM manipulation, event listening, and WebGL rendering within a browser context.
Sanitization: There is no evidence of filtering or sanitization of external content before it is processed by the agent.

webgl-3d-object