The Agent Skills Directory

[SAFE]: The skill documents and enforces the use of escaped output ({{ }}) by default to mitigate Cross-Site Scripting (XSS) risks, while clearly warning that unescaped output ({{{ }}}) should only be used for trusted and sanitized content.
[SAFE]: It provides guidance on using the @form() component, which automatically handles CSRF token injection and supports secure HTTP method spoofing for non-GET/POST requests.
[SAFE]: The instructions incorporate authorization best practices by teaching the use of @can and @cannot tags to conditionally render UI based on server-side policies and abilities.
[SAFE]: The skill explicitly instructs developers to remove debug-only tools like the @dump() tag before completion, reducing the risk of accidental sensitive data exposure in production environments.
[SAFE]: Use of provide/inject and context sharing is restricted to tightly coupled component families, following the principle of least privilege for data access within the template layer.

edge