The Agent Skills Directory

[DYNAMIC_EXECUTION]: The skill uses the @atscript/ui-fns plugin to compile annotation strings (e.g., @ui.form.fn.label, @ui.form.fn.hidden, or @ui.form.validate) into JavaScript functions at runtime. This process involves the new Function constructor through the FNPool utility from the @prostojs/deserialize-fn package. While references/dynamic-fields.md explicitly warns developers that these strings must be author-controlled and never sourced from untrusted users, this provides a mechanism for dynamic code generation and execution within the agent's environment.
[EXTERNAL_DOWNLOADS]: The skill documentation instructs the user to install several Node.js packages using pnpm and npx, including @atscript/core, @atscript/typescript, @atscript/ui, @atscript/vue-form, and @atscript/ui-fns. These are vendor-owned resources belonging to the moostjs developer.
[INDIRECT_PROMPT_INJECTION]: As a UI framework for agents, the skill establishes an attack surface for indirect prompt injection.
Ingestion points: Data enters the skill's context via the formData and formContext props passed to the <AsForm> component.
Boundary markers: The skill does not explicitly define delimiters for separating user-provided data from agent instructions within the form context.
Capability inventory: The skill is capable of performing network requests (e.g., querying API endpoints for foreign key lookups via ValueHelpClient) and submitting form data to external services.
Sanitization: The AsConsentArray component includes sanitization logic that restricts markdown links in descriptions to http, https, and mailto protocols, mitigating some potential injection vectors in those fields.

atscript-ui-forms