The Agent Skills Directory

Indirect Prompt Injection Surface: The instructions describe patterns for HybridWebView messaging (RawMessageReceived), which allows data to flow from a JavaScript/web environment into the native .NET context. While this is a core framework feature, it represents a surface where untrusted data could influence application logic. The skill mitigates this by explicitly recommending the use of typed JSON DTOs, source-generated serialization, and mandatory schema validation and authorization checks at the .NET receiver.
Ingestion points: HybridWebView.RawMessageReceived in SKILL.md.
Boundary markers: Recommends using DTO contracts and explicit System.Text.Json source generation boundaries.
Capability inventory: The skill mentions maui_cdp_evaluate (dynamic JavaScript execution) and general .NET dispatch logic for handling messages.
Sanitization: The instructions provide clear guidance to validate payloads against expected schemas and perform authorization checks before triggering sensitive operations.
Dynamic Execution Surface: The skill references debugging tools like maui_cdp_evaluate and maui_cdp_source, which enable the evaluation of JavaScript and inspection of source code within the application's WebView. These are standard developer tools but involve runtime code evaluation. The skill advises that these capabilities and associated developer tools should only be enabled in debug configurations.
Command Execution: The workflow includes the use of the maui devflow mcp command, which is a utility for managing developer workflows. As a vendor-provided tool from a trusted source, its inclusion is part of the intended development experience.
Secure Data Management: The guide includes proactive security advice, specifically warning against the storage of long-lived secrets in browser local storage and recommending that WebView developer tools be disabled in release builds to prevent unauthorized access.

maui-blazor-hybrid