The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill possesses a surface for indirect prompt injection as it ingests untrusted user intent to generate form definitions.
Ingestion points: INTENT.md captures user descriptions of form fields and types.
Boundary markers: A mandatory approval gate is implemented in SAVE.md that requires explicit user confirmation before any form_create or form_update operations are executed.
Capability inventory: The skill uses form_create, form_update, form_get, and form_list MCP tools to interact with the Form.io project.
Sanitization: Handoff to the specialized formio-schema skill for JSON generation and relying on the Form.io MCP server's internal validation provides structural sanitization of inputs.
[SAFE]: The skill includes a specific security measure in SAVE.md to prevent accidental data exposure by flagging and requiring separate approval for any form definitions that widen access permissions beyond project defaults.
[SAFE]: Authentication is handled via the platform's native portal-login flow. The instructions explicitly steer the agent away from using hardcoded keys or insecure authentication methods.

formio-form-builder