The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill provides instructions to download and install a formatting tool from a repository controlled by the skill author.
Evidence: cargo install --git https://github.com/hyperpuncher/dsfmt in SKILL.md.
Evidence: Fetches the framework bundle from a public CDN: https://cdn.jsdelivr.net/gh/starfederation/datastar@v1.0.2/bundles/datastar.js.
[DYNAMIC_EXECUTION]: The framework described in the skill evaluates signals and expressions using dynamic JavaScript execution, which is a core part of its reactivity model.
Evidence: Datastar evaluates expressions with Function(). in references/frontend.md.
Evidence: Backend actions can return text/javascript which is executed in the browser, as noted in references/backend.md.
[INDIRECT_PROMPT_INJECTION]: The skill is designed to process backend-driven DOM updates and expressions, creating a surface for instructions embedded in data received from external endpoints.
Ingestion points: SKILL.md (SSE patches), references/backend.md (HTML, JSON, and SSE responses).
Boundary markers: The skill mentions using data-ignore to isolate unsafe content and stresses escaping user input in references/frontend.md.
Capability inventory: The framework can execute JavaScript expressions, handle DOM events, and perform network requests (@get, @post, etc.) as documented in references/frontend.md.
Sanitization: Instructions recommend validating and authorizing all requests on the backend and escaping input before placing it in expressions in SKILL.md.

datastar