The Agent Skills Directory

[SAFE]: The skill implements a standalone Python script that generates static HTML/JS files based on provided configuration. It does not perform network operations, access sensitive system files, or execute external code.
[COMMAND_EXECUTION]: The script uses standard command-line argument parsing and file I/O to transform JSON data into HTML templates. This behavior is restricted to the local environment and the specific files requested by the user.
[INDIRECT_PROMPT_INJECTION]: While the skill processes external data (JSON), it mitigates injection risks through proactive sanitization:
Ingestion points: The script scripts/generate_timeline.py reads data from files or standard input.
Sanitization: All user-controlled text fields are processed using html.escape() before being inserted into the HTML structure. Theme-related fields (colors, fonts) are filtered using a regular expression to prevent CSS injection and style-block breakout.
Boundary markers: Not explicitly present in instructions, but the tool's limited scope (static file generation) restricts potential impact.
Capability inventory: The tool can only read local JSON files and write to local output paths specified via CLI arguments.
[EXTERNAL_DOWNLOADS]: The skill has no external dependencies and uses only the Python standard library.

timeline-builder