The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill provides code blueprints for Next.js that ingest external data and render it into executable contexts, creating a potential XSS vulnerability.
Ingestion points: The getPageData function in app/[service]/[city]/page.tsx fetches data from external sources including "Web scraping", "User-generated content", and "Public APIs" as described in the Data Source section.
Boundary markers: The code snippets do not include logic for sanitizing or validating the content retrieved from these external sources before use.
Capability inventory: The Page component in app/[service]/[city]/page.tsx uses dangerouslySetInnerHTML to inject the jsonLd object into a script tag, which can execute code in the user's browser.
Sanitization: While JSON.stringify is used, the use of dangerouslySetInnerHTML without pre-sanitization of the input fields (e.g., data.title) allows for potential script injection if the source data contains malicious payloads like </script><script>alert(1)</script>.

programmatic-seo