The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill provides a reference implementation for updating a combobox in real-time where data from an external WebSocket is injected directly into the DOM using innerHTML without sanitization.
Ingestion points: references/2024-03-12-hotwire-combobox-with-real-time-data.md (WebSocket message event handler in external_websocket_controller.js).
Boundary markers: Absent; the state value extracted from the WebSocket JSON payload is passed directly to the receiving controller without validation or delimitation.
Capability inventory: The receiver Stimulus controller possesses the capability to modify the innerHTML of listbox options and other DOM elements.
Sanitization: Absent; the changeLabel method uses this.element.innerHTML.replace() to insert the state variable into the HTML string, which creates an XSS vulnerability if the WebSocket source serves malicious content.

hwc-realtime-streaming