The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill facilitates the installation of companion tools and rule sets from external sources. Specifically, it uses npx skills add to fetch skills from GitHub repositories managed by established and trusted organizations such as Vercel Labs and Supabase. This is documented as a standard ecosystem practice.\n- [REMOTE_CODE_EXECUTION]: During the project initialization phase, the skill executes scaffolding commands that download templates from a remote repository (github.com/whopio/whop-nextjs-app-template). This template is provided by the well-known service the skill is designed for, representing a standard and expected deployment pattern.\n- [INDIRECT_PROMPT_INJECTION]: The skill guides the creation of applications that process external data, such as member emails, forum posts, and chat messages via the Whop SDK. Ingesting untrusted content into an agent's context constitutes a surface for indirect prompt injection. The skill mitigates this by providing a dedicated input-sanitization.md rule and a security checklist.\n
Ingestion points: Data from Whop SDK (memberships, forum posts, chat messages) and user input forms in scaffolded apps.\n
Boundary markers: Not explicitly enforced in provided prompt templates, though sanitization rules are included to handle the data programmatically.\n
Capability inventory: File system operations (scaffolding), network requests (Whop API), and the ability to execute companion skills.\n
Sanitization: Included in rules/input-sanitization.md using regex patterns for XSS prevention and recommendations for standard sanitization libraries like DOMPurify.\n- [DYNAMIC_EXECUTION]: The provided React layout templates utilize dangerouslySetInnerHTML to inject a small, constant JavaScript snippet for theme management (dark mode flickering prevention). This is a common performance optimization for Server-Side Rendering (SSR) frameworks and the script performs only benign DOM-related tasks.

whop-dev