The Agent Skills Directory

[SAFE]: A thorough analysis of the skill's instructions and example code revealed no malicious instructions, persistence mechanisms, or attempts to bypass security filters. The skill is a standard technical reference resource.
[EXTERNAL_DOWNLOADS]: The documentation includes references and code snippets for loading JavaScript SDKs from verified services including Tencent (res.wx.qq.com, gtimg.cn), Baidu (bdstatic.com), and ByteDance (bytegoofy.com). These resources are essential for enabling framework-specific features in hybrid environments and are documented neutrally.
[DATA_EXFILTRATION]: The skill provides usage examples for framework APIs that interact with device data, including GPS coordinates, camera metadata, and local application storage. These examples are aligned with the skill's primary educational purpose and do not contain logic for unauthorized data transmission.
[PROMPT_INJECTION]: The documentation for components such as web-view and rich-text indicates that they can render external HTML and web content. This identified surface could theoretically facilitate indirect prompt injection if untrusted content is processed without caution.
Ingestion points: references/components/built-in/web-view.md and references/components/built-in/rich-text.md through the src and nodes properties.
Boundary markers: Not implemented in the provided documentation snippets.
Capability inventory: Framework APIs for networking and data persistence documented throughout the examples/api/ directory.
Sanitization: Not implementation in the basic baseline examples.

uniapp-project