The Agent Skills Directory

[UNVERIFIABLE_DEPENDENCIES]: The skill instructions direct the agent to run npm install for dependencies and the code fetches images from remote URLs to convert them into data URLs for inclusion in slides.
[DYNAMIC_EXECUTION]: The tool uses Puppeteer to render generated HTML templates containing user data before converting the rendered output into a PPTX file.
[INDIRECT_PROMPT_INJECTION]: The skill ingests user requirements and interpolates them into HTML templates that are rendered in a browser environment, presenting an attack surface for indirect injection.
Ingestion points: User-provided topic and requirements in SKILL.md (Step 1).
Boundary markers: None identified in the HTML generation logic.
Capability inventory: Shell command execution (node), network requests (fetch), and browser execution (puppeteer).
Sanitization: Content is largely treated as text, but richtext fields use innerHTML without sanitization.

qoderwork-ppt