The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill is designed to process untrusted user input (UI requirements) to generate React code. There is an attack surface for indirect prompt injection where malicious instructions could be embedded in the UI request to influence the agent's behavior during the code generation or verification process.
Ingestion points: User prompts provided at runtime to define UI requirements (referenced in SKILL.md).
Boundary markers: Absent in the skill instructions.
Capability inventory: Generates React code and utilizes a local-testing skill (referenced in SKILL.md) for browser-based verification.
Sanitization: No specific sanitization or filtering of user-provided content is mentioned before interpolation into code templates.
[EXTERNAL_DOWNLOADS]: The instructions describe the use of official LobeHub packages and assets (icons, emojis, and charts) that may be fetched from well-known and established Content Delivery Networks (CDNs) including Aliyun, unpkg, and jsdelivr. These are standard, reputable sources for web assets.
[SAFE]: The skill demonstrates high technical maturity by enforcing strict coding standards (e.g., forbidding deprecated components and hardcoded style values) and providing a structured evaluation framework for output quality.

lobe-design