The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill facilitates the installation of the mustache package from the npm registry, which is a well-known and widely-used library for logic-less templating.
[PROMPT_INJECTION]: The skill documents template rendering which constitutes an attack surface for indirect prompt injection. If untrusted data is included in the template or the view object, particularly when using unescaped tags like {{{key}}} or {{&key}}, malicious instructions could be processed.
Ingestion points: The skill uses Mustache.render to process template strings and view objects.
Boundary markers: None provided in the instructions to separate untrusted data.
Capability inventory: The skill allows template rendering and provides examples of network fetching via fetch().
Sanitization: The library provides default HTML escaping for standard tags.

mustache