The Agent Skills Directory

[SAFE]: The skill utilizes well-known and trusted Node.js libraries, including @hotwired/stimulus, @hotwired/turbo, stimulus-use, and blurhash. All external service references, such as those for YouTube video embeds and image placeholders, originate from established and reputable technology providers.
[SAFE]: Best practices for resource management and memory safety are followed throughout the provided code samples. The implementation ensures that blob URLs are revoked immediately after use and that third-party library instances are explicitly destroyed in the controller's disconnect callback.
[PROMPT_INJECTION]: Indirect Prompt Injection Surface Analysis: The skill contains patterns for ingesting and displaying untrusted data (e.g., file names, user input) within the local DOM. This is a standard functional requirement for the media features described and is not associated with any exploitable or dangerous capabilities.
Ingestion points: file.name in image-upload-previews.md and this.markerDescriptionTarget.value in wavesurfer-markers.md.
Boundary markers: Not utilized in the template examples.
Capability inventory: No high-risk capabilities such as shell execution, filesystem writes, or data exfiltration are present in the controller logic.
Sanitization: Not explicitly present in the instructional templates; recommended as a security best practice for production implementations.

media-content