The Agent Skills Directory

[PROMPT_INJECTION]: The InventoryUI.updateSlot method in SKILL.md utilizes innerHTML to render the itemName variable within a template string. This creates a vulnerability surface for indirect prompt injection or cross-site scripting (XSS) if the item names are sourced from untrusted user input or external APIs.\n
Ingestion points: The itemName parameter of the InventoryUI.updateSlot method in SKILL.md.\n
Boundary markers: None. The input is directly interpolated into the HTML structure without delimiters or instructions to ignore embedded tags.\n
Capability inventory: The method performs direct DOM manipulation using innerHTML, which can execute injected scripts.\n
Sanitization: There is no evidence of sanitization, HTML escaping, or validation performed on the itemName input prior to its insertion into the DOM.

ui-system