The Agent Skills Directory

EXTERNAL_DOWNLOADS (LOW): The skill relies on the playwright package, which downloads and executes browser binaries (Chromium) during its setup and operation.
Evidence: Found require('playwright') in scripts/export-slides.js and installation instructions in SKILL.md.
Note: Microsoft (the author of Playwright) is a trusted organization, which downgrades the severity of this external dependency finding per [TRUST-SCOPE-RULE].
INDIRECT_PROMPT_INJECTION (LOW): The skill processes external data (JSON, YAML, Markdown) and renders it into HTML that is subsequently executed in a browser environment.
Ingestion points: scripts/export-slides.js (accepts HTML file paths), scripts/generate-presentation.js (accepts JSON/YAML content).
Boundary markers: Absent. There are no delimiters or warnings to the LLM to ignore instructions found within the presentation content.
Capability inventory: The skill can write files to the local system (PNG, PDF, WebM) and the browser can potentially make network requests if the input HTML contains scripts or external resources.
Sanitization: Absent. The provided scripts do not show any sanitization of the input content, meaning malicious HTML or JavaScript could be rendered and executed within the Playwright context.

presentation-generator