The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The framework described in the skill evaluates expressions using the Function() constructor, creating a vulnerability surface where data provided by a backend or a user could lead to arbitrary script execution if not correctly sanitized.
Ingestion points: Untrusted data can enter the agent context through backend-driven HTML patches, SSE events, and signal updates as described in SKILL.md and references/backend.md.
Capability inventory: The framework allows client-side JavaScript execution via Function() for all attribute expressions and supports text/javascript response types for direct script execution.
Boundary markers: references/frontend.md contains explicit warnings: "Never insert unescaped user input into Datastar expressions: expressions can execute JavaScript."
Sanitization: The instructions emphasize that the developer must manually escape user input before placing it into expressions and treat signals as untrusted input to be validated on the backend.
[EXTERNAL_DOWNLOADS]: The skill recommends installing a formatting tool, dsfmt, from a remote GitHub repository (https://github.com/hyperpuncher/dsfmt) using the cargo install command. While this tool is provided by the skill's author, it involves downloading and installing external software.
[DYNAMIC_EXECUTION]: Datastar relies on runtime evaluation of expressions contained within HTML attributes (e.g., data-on, data-text) using Function(). As noted in the references/frontend.md, this necessitates a Content Security Policy (CSP) that allows unsafe-eval.

datastar