The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill instructions direct users to run npx shadcn@latest add https://ui.inference.sh/r/widgets.json, which downloads and integrates code from an external remote registry.
[COMMAND_EXECUTION]: The documentation encourages the installation of multiple external skills using npx skills add belt-sh/cli and various sub-skills from inference-sh/skills, which initiates remote script fetching and execution during installation.
[INDIRECT_PROMPT_INJECTION]: The skill provides a WidgetRenderer component that processes structured agent responses to generate interactive UI elements, creating a surface for adversarial manipulation if the agent is compromised.
Ingestion points: WidgetRenderer widget property (SKILL.md).
Boundary markers: Absent; the skill does not define delimiters to distinguish between trusted UI and data-driven injections.
Capability inventory: Renders functional UI components including forms, inputs, and buttons with associated actions (SKILL.md).
Sanitization: Not specified; security depends on the implementation of the onAction handler by the end-user.

widgets-ui