The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill documents patterns for ingesting external data via fetch in components and composables (e.g., in references/core-new-apis.md). While this creates a surface for indirect prompt injection if the processed data contains instructions intended to influence the agent, Vue's default template rendering using {{ }} provides automatic HTML escaping, and the examples follow standard web development security practices.
[REMOTE_CODE_EXECUTION]: Code examples demonstrate the use of fetch for API calls and defineAsyncComponent for lazy loading components. These are standard framework features for building web applications and do not involve executing untrusted remote scripts or shell commands in the agent's execution environment.
[DYNAMIC_EXECUTION]: The skill references dynamic component rendering using the :is attribute and defineAsyncComponent. These are built-in Vue features for runtime component resolution and do not represent unsafe dynamic execution patterns like eval() or exec() on untrusted input.

vue