The Agent Skills Directory

[REMOTE_CODE_EXECUTION]: The skill facilitates dynamic execution of JavaScript logic defined within Atscript (.as) files. Specifically, the @atscript/ui-fns package implements a DynamicFieldResolver that compiles annotation strings (like @ui.form.fn.hidden or @ui.form.validate) into executable code.
Evidence: references/dynamic-fields.md states that strings are wrapped in return (${fnStr})(...) and executed via new Function. It explicitly warns that there is no sandbox and no allow-list of identifiers, allowing code to access globals like fetch, localStorage, and window.
[EXTERNAL_DOWNLOADS]: The skill relies on and instructs the user to install a wide range of external Node.js packages from the @atscript and moostjs organizations.
Evidence: SKILL.md and references/getting-started.md list dependencies such as @atscript/vue-form, @atscript/ui-fns, and unplugin-atscript.
[COMMAND_EXECUTION]: The installation process involves executing shell commands that fetch and execute remote scripts or add platform-specific skill sets.
Evidence: SKILL.md includes commands like npx skills add moostjs/atscript-ui and pnpm add for various library components.
[DATA_EXFILTRATION]: The foreign key reference system (AsRef) is designed to perform network operations to resolve labels and data from remote HTTP endpoints.
Evidence: references/actions-refs.md describes the ValueHelpClient flow, which uses @db.http.path to query external URLs for data searching and selection.
[PROMPT_INJECTION]: The skill introduces an indirect prompt injection surface by processing structured type definitions that can contain executable logic, creating a path from data to execution.
Ingestion points: .as files and their metadata annotations processed by createAsFormDef and installDynamicResolver (as seen in SKILL.md and dynamic-fields.md).
Boundary markers: None identified in the documentation to isolate untrusted annotation content from the execution context.
Capability inventory: The skill provides access to new Function execution (via ui-fns) and network access (via ValueHelpClient and the Client class).
Sanitization: The documentation in references/dynamic-fields.md explicitly notes the absence of sandboxing or input validation for annotation strings.

atscript-ui-forms