The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill instructs the user to install external tools and UI components from remote sources using the npx package runner.
Evidence: The skill includes commands to add components from https://ui.inference.sh/r/chat.json and a CLI tool from belt-sh/cli.
[INDIRECT_PROMPT_INJECTION]: The skill provides UI components (ChatMessage, ChatInput) intended to display and process untrusted user data, which can be exploited if malicious instructions are embedded in the chat messages.
Ingestion points: Data enters the agent's environment through the content prop of the ChatMessage component and the onSubmit handler of the ChatInput component in SKILL.md.
Boundary markers: Absent; there are no delimiters or explicit instructions in the provided snippets to ignore potential commands embedded within the rendered chat content.
Capability inventory: No dangerous system capabilities such as file-system writes, subprocess execution, or direct network exfiltration were identified within the UI code blocks in SKILL.md.
Sanitization: Absent; the provided implementation examples do not demonstrate sanitization, filtering, or escaping of message content before it is rendered in the UI.

chat-ui