The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill includes logic for parsing URL parameters and peer-provided strings. It mitigates injection risks by recommending a fixed registry for actions, limiting argument length, and using textContent for UI labels.
[COMMAND_EXECUTION]: The provided Vite plugin enables writing tuning values to src/tuning.json. It implements defensive measures including Host and Origin header validation to prevent CSRF and DNS-rebinding, and uses a schema-shape check to block prototype pollution.
[DYNAMIC_EXECUTION]: Instructions explicitly discourage the use of eval() or the Function() constructor, advocating for safe lookup mechanisms for triggering dev tools.
[EXTERNAL_DOWNLOADS]: The skill suggests using well-known, MIT-licensed libraries for developer interfaces, such as lil-gui, Tweakpane, stats.js, and stats-gl.

harmony-devtools