The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill's documentation and examples recommend installing the reflex framework via the standard pip install command to set up the development environment.
[INDIRECT_PROMPT_INJECTION]: The file upload implementation example in examples/file_upload.py demonstrates a vulnerability surface for path traversal attacks. While it validates file extensions, it directly uses user-supplied filenames when writing files to the local disk.
Ingestion points: The rx.upload component in examples/file_upload.py receives files from the end-user.
Boundary markers: The processing logic lacks explicit boundary markers or instructions to prevent the execution of embedded commands or path manipulation characters.
Capability inventory: The skill involves filesystem write operations using open(outfile, "wb") within the handle_upload async function.
Sanitization: The implementation checks file suffixes against an allowed_extensions list but does not sanitize the filename to prevent the use of relative path components like ../.

reflex-dev