The Agent Skills Directory

[CREDENTIALS_UNSAFE]: The skill contains hardcoded dummy credentials used for educational purposes in example scripts.
Evidence: In examples/python/basic_form.py, a simulated login check uses credentials.email == "test@example.com" and credentials.password == "Password123!" to demonstrate authentication logic.
Evidence: In examples/python/flask_wtf_example.py, the SECRET_KEY is set to a placeholder value your-secret-key-here.
Context: These are clearly marked as test/example values and are standard for documentation and code templates.
[INDIRECT_PROMPT_INJECTION]: The skill provides an extensive surface for ingesting untrusted user data through form interfaces.
Ingestion points: API endpoints in examples/python/basic_form.py (lines 53, 122, 178) and examples/python/fastapi_forms.py (lines 66, 88, 120) ingest structured data from request bodies.
Boundary markers: Present. Data is structured via Pydantic models (Python) and Zod schemas (JavaScript), providing clear boundaries between data fields.
Capability inventory: The example scripts perform data validation, logic branching, and console logging. They do not demonstrate dangerous file system writes or unauthorized network requests using the ingested data.
Sanitization: Present. The skill heavily emphasizes strict validation using Pydantic, Zod, and regex patterns to filter and validate input before processing.

building-forms