The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes external JSON data that could contain malicious instructions for an agent.
Ingestion points: The refresh() method in SKILL.md fetches JSON data from external URLs via the src attribute or <script src="..."> tags. The onDrop() method reads user-provided files via FileReader.
Boundary markers: Absent. The skill does not use delimiters or warnings to isolate external data from the agent's context.
Capability inventory: The skill performs network operations via fetch, reads local files via FileReader, and renders data into the DOM.
Sanitization: External JSON data is parsed and rendered directly into the template (e.g., this.data?.name) without content validation or instruction filtering.
[EXTERNAL_DOWNLOADS]: The skill downloads dependencies and data at runtime.
Installs packages lit, force-graph, and 3d-force-graph from the NPM registry.
Fetches graph data from remote URLs specified in the component's attributes.
[COMMAND_EXECUTION]: The tutorial provides shell commands for project setup.
Instructions include executing npm init and npm install to set up the development environment.

2d-or-3d-force-graph-with-lit