The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill facilitates the processing of user-supplied rich text content (HTML), which serves as a potential surface for indirect injection and Cross-Site Scripting (XSS).
Ingestion points: Data enters the application through the has_rich_text attribute as defined in the model pattern in SKILL.md.
Boundary markers: The instructions explicitly highlight Rails' default sanitization and provide clear warnings to exclude dangerous tags from safe-lists.
Capability inventory: The skill uses ActiveStorage for managing file attachments and performs database writes through migration scripts and model updates.
Sanitization: The skill relies on the Rails::Html::SafeListSanitizer and explicitly advises against adding <script>, style, or onclick to the allowed attributes.
[COMMAND_EXECUTION]: The documentation contains standard Rails command-line instructions for setting up the environment and database.
Evidence: The Setup section in SKILL.md includes bin/rails action_text:install and bin/rails db:migrate.

actiontext-richtext