The Agent Skills Directory

[PROMPT_INJECTION]: The skill utilizes a reactive templating system ({{ expression }}) and an Rx expression builder that interpolates state data into UI components and action arguments, creating a surface for indirect prompt injection.
Ingestion points: Data enters the agent's context through user inputs (e.g., Input, Form) and results from external tools mapped to state via the result_key parameter in CallTool actions.
Boundary markers: The documentation does not specify the use of delimiters or 'ignore' instructions when rendering data from untrusted sources into components like Markdown or Text.
Capability inventory: The skill supports triggering powerful actions such as CallTool, SendMessage, and OpenLink using values derived from client-side state.
Sanitization: There is no mention of sanitization, escaping, or validation of data before it is interpolated into templates or passed to actions like SendMessage.

prefab-ui