The Agent Skills Directory

[SAFE]: The skill provides documentation for the FineUI framework across multiple deployment stacks including F.js, Pro, Core, and Java.
[SAFE]: Documentation includes a dedicated section on the "RawHtml" security model, which enforces HTML encoding by default to prevent Cross-Site Scripting (XSS) vulnerabilities.
[SAFE]: The instructions explicitly recommend disabling legacy and potentially dangerous features like AllowDangerousRawTag and AllowDangerousScriptTag in project configurations.
[INDIRECT_PROMPT_INJECTION]: The skill informs the agent on how to interpret and generate code based on user project files. While this creates an attack surface for processing untrusted user input, the instructions prioritize security and sanitization (e.g., using RawHtml for trusted content and default encoding for untrusted content). 1. Ingestion points: User project code (aspx, html, cs, java files). 2. Boundary markers: Encourages use of RawHtml markers to distinguish trusted vs untrusted content. 3. Capability inventory: The skill involves interpreting logic for UI components but does not invoke dangerous shell commands or network exfiltration. 4. Sanitization: Explicitly teaches the framework's internal sanitization mechanisms.
[SAFE]: All external URLs point to the official fineui.com domain for API documentation and examples.

fineui-foundation