The Agent Skills Directory

[SAFE]: The documentation provides explicit security guidance for developers, specifically advising against the use of innerHTML and outerHTML to prevent Cross-Site Scripting (XSS) vulnerabilities in favor of safer DOM APIs like textContent.
[SAFE]: The skill recommends using Obsidian's requestUrl() API for all network operations to safely bypass CORS restrictions and advises developers to type-check and validate all response data at the API boundary to prevent unsafe data leakage.
[SAFE]: Detailed instructions for memory management and component lifecycle handling are provided, promoting the use of registerEvent() and registerDomEvent() to ensure proper cleanup and prevent memory leaks.
[INDIRECT_PROMPT_INJECTION]: While the skill processes user-supplied plugin code, it includes comprehensive mandatory evidence for safety: it identifies clear ingestion points for untrusted data, provides strong sanitization guidance through its DOM and network API rules, and lacks high-privilege automated execution of processed data, maintaining a safe posture.
[SAFE]: The skill defines mandatory accessibility (A11y) standards, including keyboard navigation support, ARIA labels, and focus management, ensuring that developed plugins are inclusive and compliant with industry standards.

obsidian