The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The widget templates provided in the skill documentation exhibit a vulnerability surface for cross-site scripting (XSS) within the sandboxed iframe context.
Ingestion points: Untrusted JSON data enters the widget via the app.ontoolresult handler as shown in SKILL.md and references/widget-templates.md.
Boundary markers: The host environment isolates widgets using an HTML sandbox attribute and Content Security Policy (CSP), but the widget maintains powerful capabilities within the session.
Capability inventory: Scripts executing within the widget can utilize the App instance to call app.sendMessage (which injects messages into the chat with the user role), app.updateModelContext (silent context updates), and app.callServerTool (direct server-side tool execution), as documented in references/apps-sdk-messages.md.
Sanitization: Templates in SKILL.md and references/widget-templates.md render data fields such as c.name, c.email, it.label, and it.sub using innerHTML. If these fields originate from untrusted sources (e.g., external search results or databases), they could facilitate arbitrary code execution within the iframe, potentially allowing an attacker to manipulate the conversation or trigger server-side tools.
[DYNAMIC_EXECUTION]: The server-side implementation examples utilize a dynamic code inlining pattern to deliver the browser-side SDK.
Evidence: In SKILL.md and references/iframe-sandbox.md, the server reads the @modelcontextprotocol/ext-apps/app-with-deps bundle from the local file system and uses regex-based string manipulation to convert module exports into global assignments before injecting the code into the served HTML.
Context: This technique is used to bypass CSP restrictions that prevent sandboxed iframes from loading scripts from external CDNs. While it constitutes runtime script generation, it is a documented requirement for the platform's widget architecture.

build-mcp-app