The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill fetches UI assets such as profile pictures and placeholder images from external services during example execution.
Evidence: GitHub avatar URLs in components/display/avatar.md and Picsum image URLs in components/layout/card_image.md.
Context: These are standard practices for UI examples and use well-known, established domains.
[EXTERNAL_DOWNLOADS]: The documentation references a remote JavaScript file for implementing a web loading screen.
Evidence: guides/web_preloader.md suggests using a script from cdn.jsdelivr.net.
Context: The script is a vendor resource belonging to the author's own repository, providing legitimate loading functionality for Flutter web applications.
[INDIRECT_PROMPT_INJECTION]: The skill implements various text input components which represent potential ingestion surfaces for untrusted data when used in an agent's UI.
Ingestion points: components/form/input.md (TextField), components/form/text_area.md (TextArea), and components/form/chip_input.md.
Boundary markers: Absent in the UI component definitions.
Capability inventory: The skill defines UI presentation; subsequent data processing depends on the agent's logic.
Sanitization: Not provided within the UI component layer.
Context: As a UI component library, providing these input fields is the intended primary purpose. The risk is inherent to all UI inputs and does not indicate a specific vulnerability in the skill's instructions.

shadcn-flutter