The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill instructs the user to install the belt-sh/cli and other related skills (inference-sh/skills@agent-ui, etc.) using npx.
Evidence: npx skills add belt-sh/cli and npx skills add inference-sh/skills@agent-ui.
[EXTERNAL_DOWNLOADS]: The skill uses the shadcn CLI to fetch and add components from a remote registry hosted on ui.inference.sh.
Evidence: npx shadcn@latest add https://ui.inference.sh/r/tools.json.
[INDIRECT_PROMPT_INJECTION]: The UI components (ToolCall, ToolResult, ToolApproval) are designed to display data returned by external tools and agents, creating a surface for indirect prompt injection if the ingested data contains malicious instructions targeting the viewing agent.
Ingestion points: Tool arguments in ToolCall/ToolApproval and results in ToolResult components (SKILL.md).
Boundary markers: None explicitly documented to handle or separate untrusted data within the UI components.
Capability inventory: The skill is a component library and does not contain internal subprocess or network capabilities; however, it is intended to be used within an environment that has these capabilities.
Sanitization: Standard React rendering provides text escaping, but structured objects passed to args or result props may be rendered without specific validation against embedded instructions.

tools-ui