The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill provides examples of Stimulus controllers that process data from external sources (such as JSON values or WebSocket messages) and render it directly to the page.
Ingestion points: The JobDashboardController in references/2023-12-19-stimulus-outlets-api.md processes a jobs array containing job objects.
Boundary markers: No explicit boundary markers or instructions to ignore embedded HTML/scripts are present in the provided templates.
Capability inventory: The controller uses insertAdjacentHTML to inject generated HTML strings into the listTarget.
Sanitization: The implementation uses String.prototype.replaceAll() for templating without escaping or sanitizing the values of job.id or job.type, which could lead to cross-site scripting (XSS) if these values are attacker-controlled.
[DYNAMIC_EXECUTION]: The skill demonstrates the generation of HTML elements at runtime through string concatenation and template manipulation.
Evidence: In references/2023-12-19-stimulus-outlets-api.md, the JobDashboardController clones a template's content and performs string replacements on its outerHTML before inserting it into the DOM.
[EXTERNAL_DOWNLOADS]: The skill's HTML examples reference external JavaScript libraries from a Content Delivery Network (CDN).
Evidence: The references/2024-06-18-fundamentals-core-web-vitals.md file contains an import map that fetches @hotwired/turbo and @hotwired/stimulus from the jspm.io CDN.
[DATA_EXFILTRATION]: The skill includes examples of network operations that target dynamic URLs provided via controller state.
Evidence: In references/2025-11-25-stimulus-web-share-api.md, the getFile() method performs a fetch() request on this.fileValue, which is a value that can be set to any arbitrary URL via HTML data attributes.

hwc-stimulus-fundamentals