The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill architecture is vulnerable to injection because it ingests data from external sources and interpolates it into the agent's output context without sanitization.
Ingestion points: Data is retrieved from Cloudflare KV (env.CITY_KV.get) and D1 Database (env.DB.prepare(...).first()) in SKILL.md.
Boundary markers: None are used to separate data from the HTML structure.
Capability inventory: The skill generates and returns full HTML responses to the client.
Sanitization: The renderPage function lacks escaping or sanitization for city.name, city.state, service.name, and service.description, and performs a direct string replacement on service.template. If these data sources are compromised or contain untrusted user input, arbitrary scripts can be executed.
[DYNAMIC_EXECUTION]: The implementation performs dynamic assembly of executable content (HTML/JS) at runtime.
Evidence: The renderPage function in SKILL.md uses template literals and String.prototype.replace to construct the final HTML document delivered to the browser.
Risk: While this is a standard pattern for web rendering, the combination with unsanitized external data sources creates an injection risk.

edge-rendering