The Agent Skills Directory

[PROMPT_INJECTION]: The skill defines a mechanism for the agent to read application state generated by the UI (readAppState). This creates a surface for indirect prompt injection if the UI outputs malicious instructions that the agent later interprets.
Ingestion points: window.slotContext in SKILL.md receives data from the chat context.
Boundary markers: Scoped extensionId is mentioned; explicit warning against hardcoding secrets.
Capability inventory: appAction, appFetch, dbQuery, dbExec, extensionFetch, agentNative.chat.send.
Sanitization: Not explicitly defined for the output state read by the agent.
[REMOTE_CODE_EXECUTION]: The skill's primary purpose is the dynamic generation and rendering of Alpine.js HTML and JavaScript within the chat interface. This behavior is the intended functionality of the "Generative UI" system.
[COMMAND_EXECUTION]: The skill documentation mentions the dbQuery and dbExec functions for performing SQL operations. While identified as a capability, the instructions advise using them only for known tables when no other action fits.

generative-ui