The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill implementation uses the http package to download binary data representing UI components from a server (specified as http://localhost:8080/). This is the intended behavior for fetching remote assets in an SSR context.
[DYNAMIC_EXECUTION]: UI definitions are dynamically interpreted at runtime using the decodeLibraryBlob function from the rfw package. This allows the application to render interface updates provided by the server without a full application update.
[INDIRECT_PROMPT_INJECTION]: The skill creates a surface for processing remote data into UI elements. Evidence chain: 1. Ingestion points: The fetchWidget and onEvent functions in the Flutter client ingest res.bodyBytes from network responses. 2. Boundary markers: No explicit boundary markers are used as the data format is structural binary. 3. Capability inventory: Includes HTTP network operations and runtime widget library updates. 4. Sanitization: The rfw package acts as a sandbox, only allowing a restricted set of pre-defined declarative widgets, which prevents the execution of arbitrary imperative code.

server-side-rendering-flutter-apps-with-rfw