The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill instructs the agent to generate and render HTML/JS widgets which may process untrusted data from conversation history or local files.
Ingestion points: Data enters the widget via the html string parameter and the data_files parameter in the ShowWidget tool call.
Boundary markers: No specific delimiters or instruction-isolation warnings are required for the agent when interpolating data into the HTML structure.
Capability inventory: The widget has access to the sendPrompt() function to trigger follow-up agent actions and can read local sandbox files via window.__WIDGET_DATA__.
Sanitization: The skill lacks instructions for sanitizing or escaping user-controlled data before it is rendered, creating a cross-site scripting (XSS) surface within the sandboxed iframe.
[EXTERNAL_DOWNLOADS]: The skill references and encourages the use of external JavaScript libraries from well-known content delivery networks.
Evidence: Instructions explicitly permit and provide examples for loading resources from cdnjs.cloudflare.com, cdn.jsdelivr.net, unpkg.com, and esm.sh (e.g., loading chart.js from JSDelivr).
[DYNAMIC_EXECUTION]: The skill is primarily designed for the dynamic generation and execution of code at runtime.
Evidence: The ShowWidget tool executes arbitrary HTML and JavaScript fragments generated by the agent, including <script> tags for interactivity and UI logic.
[DATA_EXFILTRATION]: The skill provides a mechanism for the widget to send information back to the agent, which could be abused if the widget logic is compromised.
Evidence: The sendPrompt('text') global function allows the widget to programmatically trigger chat messages, which could be used to exfiltrate data retrieved from the window.__WIDGET_DATA__ object.

inline-widget