The Agent Skills Directory

[REMOTE_CODE_EXECUTION]: The skill documents the inclusion of vendor-provided JavaScript libraries from the official CDN (cdn.form.io). Resources from verified vendor domains are documented here as part of the standard setup process.
[DYNAMIC_EXECUTION]: The documentation covers the use of javascript triggers, customAction logic, and lifecycle hooks which allow for the execution of arbitrary JavaScript within form definitions. These are intended features of the @formio/js library for implementing complex business logic and are documented for developer use.
[INDIRECT_PROMPT_INJECTION]: The skill allows the agent to process form definitions from external URLs or JSON objects, which presents an attack surface for embedded instructions. 1. Ingestion points: Form definitions are ingested via the srcOrJson parameter in Formio.createForm (documented in references/rendering.md). 2. Boundary markers: No explicit instructions to the AI to ignore embedded logic in form definitions are provided in the examples. 3. Capability inventory: The library supports network requests via fetch or dataSrc: 'url', and execution of JavaScript snippets in triggers and hooks. 4. Sanitization: The sanitizeConfig option (using DOMPurify) is documented for HTML components and labels to mitigate XSS risks.

formio-form