The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill provides instructions to install various packages from the @json-render scope via NPM. It also references official libraries from the Vercel AI SDK (ai, @ai-sdk/openai), React Three Fiber ecosystem (@react-three/fiber, three), and data validation libraries (zod). These are standard dependencies for the described framework.
[INDIRECT_PROMPT_INJECTION]: The skill's primary function is to process data generated by an LLM to build user interfaces, which presents an inherent surface for indirect injection.
Ingestion points: Untrusted data enters the application context through AI-generated objects (generateObject, streamObject) or parsed YAML content (parseYAML).
Boundary markers: The framework uses getCatalogPrompt to provide system instructions to the AI and utilizes Zod schemas to constrain the AI's output to valid component definitions.
Capability inventory: The system can render components that trigger actions (onAction), generate documents (PDF/Email), or expose UI via the Model Context Protocol (MCP).
Sanitization: The skill demonstrates robust sanitization practices by using zod schemas in the defineCatalog function, which strictly validates all props and element structures at runtime before they are passed to the renderer.

json-render-generative-ui