The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill implements components that ingest untrusted user input from form fields, which are then passed to state management and persistence layers. This creates an attack surface for indirect prompt injection if the stored data is later processed by an LLM without proper sanitization.
Ingestion points: Onboarding form inputs in components like ProfileFormStep, EmailStep, and RoleSelect mentioned in SKILL.md and references/patterns.md.
Boundary markers: No specific boundary markers or instructions to delimit user-provided text are recommended in the implementation examples.
Capability inventory: The skill utilizes fetch for API communication, localStorage for client-side persistence, and third-party database clients like Supabase for remote storage.
Sanitization: The instructions focus on logical validation (e.g., email format) but do not provide or suggest sanitization of user-provided content before storage or interpolation.
[EXTERNAL_DOWNLOADS]: The skill directs the installation of external dependencies for its core functionality and common integration patterns.
The documentation instructs users to install @onboardjs/core and @onboardjs/react, which are vendor-owned packages associated with the skill's author.
Examples in references/patterns.md include external libraries such as @supabase/supabase-js for database persistence, next-auth for session management, and js-cookie for cookie handling.

onboardjs-react