The Agent Skills Directory

[OBFUSCATION]: The demo/index.html file contains a large Base64-encoded string used to store the HTML content for a sandboxed demo environment. This technique obscures the demo's source code and internal scripts from plain-text static analysis.
[DYNAMIC_EXECUTION]: The skill performs dynamic code generation and execution in multiple ways: it compiles WebGL shaders from strings at runtime using gl.compileShader in SKILL.md, and it populates an iframe's content via the srcdoc attribute using decoded data in demo/index.html. The demo infrastructure also uses postMessage for runtime attribute and style manipulation within the sandbox.
[REMOTE_CODE_EXECUTION]: The skill configuration in demo/source.json and demo/index.html references external scripts and assets from domains such as Supabase and public CDNs for fonts and icons (Google Fonts, Fontshare, Iconify). These references are intended to provide visual assets and functionality for the demo interface.
[INDIRECT_PROMPT_INJECTION]: The demo/PROMPT.md file encourages the agent to visit and recreate designs from external URLs. This creates an attack surface where instructions embedded in external web content could potentially influence the agent's behavior during the design generation process.
Ingestion points: Instructions in demo/PROMPT.md to visit external URLs.
Boundary markers: No explicit instructions to ignore embedded content are provided in the prompt logic.
Capability inventory: The skill allows for the generation of complex HTML, CSS, and JavaScript, including dynamic shader compilation.
Sanitization: No specific content sanitization or validation of the external reference content is performed by the skill.

webgl-laser