The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill manages the installation of the @temps-sdk/react-analytics package, which is a resource owned by the vendor 'gotempsh'. It correctly specifies a fixed version (0.0.9) and provides a Subresource Integrity (SRI) hash (sha512-qR2e1nBVc4YXxYAqmBsBpJN4wyGqv3lWh3rD+KPlo0tAQ5OS+dycqLW7W61up+76mFoeLnC1Eu74PIJcCyKoWQ==) for validation. Additionally, the instructions recommend using the --ignore-scripts flag to mitigate risks from potentially malicious lifecycle scripts.\n- [INDIRECT_PROMPT_INJECTION]: The skill facilitates the ingestion of user-generated interaction data and session recording telemetry, creating a potential attack surface for the destination analytics platform.\n
Ingestion points: User-driven events, navigation history, and DOM mutations recorded via the SDK (documented in SKILL.md and SESSION_RECORDING.md).\n
Boundary markers: The skill instructs developers to implement privacy-preserving boundaries using the maskAllInputs configuration and specific CSS classes (rr-block, rr-mask, rr-ignore) to exclude sensitive UI components.\n
Capability inventory: The SDK is limited to sending data via standard browser APIs (fetch, sendBeacon) to the designated /api/_temps ingest endpoint.\n
Sanitization: The skill includes guidance on using default and custom excluded paths to prevent the capture of sensitive information on pages like login or billing.\n- [DATA_EXFILTRATION]: The skill is designed to transmit telemetry and session data to the vendor's ingestion endpoint. This telemetry includes page views, custom events, and Web Vitals. The project-scoped ingestKey is handled as a public identifier for routing data, consistent with standard analytics platform implementations.

add-react-analytics