The Agent Skills Directory

[SAFE]: The skill follows established software engineering patterns for integrating rich text editors with Rails and Stimulus. The logic for handling autosave and audit trails is transparent and avoids risky functions.
[DATA_EXPOSURE]: The Rails controller implementation explicitly uses a constant whitelist (AUTOSAVE_FIELDS) to validate the field parameter before performing database updates via update_column. This prevents attackers from attempting to write to sensitive columns (e.g., admin, password_digest) through the autosave endpoint.
[INDIRECT_PROMPT_INJECTION]: The skill addresses potential injection and XSS risks by recommending the use of filter_html: true within the Redcarpet markdown renderer. This ensures that any malicious HTML embedded in the markdown is neutralized before being rendered in the browser.
[EXTERNAL_DOWNLOADS]: The installation instructions reference well-known and reputable packages from the NPM registry, such as @tiptap/core and @rails/request.js. These are standard dependencies for the described functionality and do not originate from untrusted or suspicious sources.
[COMMAND_EXECUTION]: All code snippets use standard framework methods for database and network operations. There is no evidence of unsafe shell execution, dynamic evaluation of user input, or dangerous system-level calls.

rails-tiptap-autosave