The Agent Skills Directory

[DYNAMIC_EXECUTION]: The skill provides detailed instructions and examples for authoring kind: 'react' pages and type: 'script' actions. These features involve generating source code (React and JavaScript) that is executed at runtime by the platform. The documentation explicitly notes that the React tier is 'trusted' and 'executed' by the runtime, and actions can bypass certain security filters (RLS/FLS) when executing server-side.
[INDIRECT_PROMPT_INJECTION]: The UI components created by this skill (such as Pages, ListViews, and Forms) are designed to ingest and display data from an external engine via providers like useAdapter or the ListView data prop. There is an inherent risk that this data could contain malicious instructions. While the skill mentions platform-level gates like metadata-protection and SecurityPlugin, it does not currently include specific guidance for the agent to sanitize this content or use boundary markers during the authoring process to prevent the data from influencing the agent's context.
[EXTERNAL_DOWNLOADS]: The skill references dependencies and components from the @objectstack/spec package and its various sub-modules (e.g., @objectstack/spec/ui, @objectstack/spec/data). These are recognized as legitimate vendor resources belonging to the skill author, 'objectstack-ai', and are documented as standard platform requirements.

objectstack-ui