The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill describes a communication bridge that processes data from external sources and handles messages between a WebView/iframe and the host application, creating a potential attack surface for indirect injection if not properly secured.
Ingestion points: Data enters the context through window.postMessage in the chart repository and useTradingViewMessageHandler in the app repository.
Boundary markers: The documentation explicitly instructs to "validate origin before reconnecting subscriptions" and "Do not bypass $private bridge routing... or origin checks."
Capability inventory: The bridge handles sensitive actions including order cancellations (tradingview_perpsOrderCancel), order price updates (tradingview_perpsOrderPriceUpdate), and K-line data fetching.
Sanitization: The skill emphasizes the requirement for origin checks and secure bridge routing to mitigate unauthorized message injection.
[DYNAMIC_EXECUTION]: The skill mentions the use of script injection for cross-environment communication.
Evidence: The documentation states that "native/desktop injects a script that calls window.postMessage(...)" via sendMessageViaInjectedScript. This is a standard architectural pattern for mobile and desktop WebView bridges used to facilitate communication between the host and the embedded web content.

1k-tradingview-communication