The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill inherently handles untrusted data through chat messages (onMessageEntered). While this creates an attack surface for indirect prompt injection, the instructions include robust security guidance. Specifically, it advises users to sanitize AI-generated content using DOMPurify before rendering it in the UI and to proxy AI requests through a backend to protect API keys.
[DYNAMIC_EXECUTION]: The skill demonstrates rendering Markdown as HTML using properties like [innerHTML], v-html, and dangerouslySetInnerHTML. These patterns are documented alongside strong warnings about XSS risks and the necessity of using sanitization libraries to mitigate these vulnerabilities.

devextreme-chat