The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill instructions include fetching and installing code from external sources using npx shadcn@latest add https://ui.inference.sh/r/widgets.json and npx skills add for packages from belt-sh and inference-sh. These sources are consistent with the skill's stated purpose and vendor infrastructure.
[INDIRECT_PROMPT_INJECTION]: The WidgetRenderer component processes JSON data to generate interactive UI elements (forms, buttons, inputs). If the input JSON is generated by an LLM based on untrusted external data, it could be used to render deceptive UIs designed to trick users into performing unintended actions.
Ingestion points: The widget prop in the WidgetRenderer component accepts JSON structured data.
Boundary markers: No explicit boundary markers or "ignore" instructions are shown in the implementation examples.
Capability inventory: The widgets support interactive actions such as click and submit via the onAction callback.
Sanitization: The provided documentation does not specify sanitization measures for the JSON inputs, though this is typical for UI library documentation.

widgets-ui