The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill demonstrates patterns for creating popups that ingest and display data from external ArcGIS Feature Services. This creates an attack surface where malicious content embedded in feature attributes could influence the application UI.
Ingestion points: Feature attributes from external FeatureLayer services (e.g., services.arcgis.com) are accessed in SKILL.md.
Boundary markers: The skill does not provide delimiters or instructions to ignore potential commands within the attribute data.
Capability inventory: The skill uses CustomContent with innerHTML and content functions that can execute logic and perform network fetch requests.
Sanitization: No explicit sanitization or escaping of attribute values is shown before rendering them in the DOM.
[DYNAMIC_EXECUTION]: The skill provides examples of dynamic UI generation through function-based content and the CustomContent class.
The creator function in CustomContent examples uses innerHTML to construct the popup DOM at runtime based on feature attributes.
Asynchronous content functions demonstrate fetching external JSON data and dynamically interpolating it into HTML templates.
[EXTERNAL_DOWNLOADS]: The skill references external resources for the ArcGIS Maps SDK.
Loads JavaScript libraries and map components from js.arcgis.com, which is the official content delivery network for ArcGIS services.
References a Feature Service from services.arcgis.com to populate the map example.

arcgis-popup-templates