The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill documents an attack surface where untrusted data could be processed through Server-Side Rendering (SSR) or hydration APIs.
Ingestion points: Data enters the agent's context through properties passed to render() and hydrate(), as well as via the hydratable() function (documented in SKILL.md and references/ssr-reference.md).
Boundary markers: The skill provides comprehensive instructions on using Content Security Policy (CSP) nonces and hashes to mitigate cross-site scripting (XSS) risks (see references/csp-reference.md).
Capability inventory: The examples demonstrate network operations using fetch() and file writing in build-time scripts (documented in examples/csp-examples.md).
Sanitization: The references/ssr-reference.md file includes a security checklist that explicitly recommends sanitizing data and validating props before rendering.
[EXTERNAL_DOWNLOADS]: The skill includes instructions for installing the vitest testing framework.
The installation command npm install -D vitest targets a well-known and widely used testing tool, which is considered a safe dependency for the intended purpose of writing component tests.

svelte-runtime