The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes content from external PDF files, creating a surface for indirect prompt injection attacks where malicious data embedded in a document might influence agent behavior.
Ingestion points: The skill reads external data via onHyperlinkClicked (link-navigation.md), form field values and changes (form-filling.md), and selected text content (text-selection.md).
Boundary markers: There are no explicit instructions for the agent to treat document data as untrusted or to wrap it in specific delimiters.
Capability inventory: The skill includes capabilities to execute shell commands (flutter create, flutter run) and perform file system writes to modify the user's project.
Sanitization: The instructions do not define methods for sanitizing or validating document content before it is processed by the agent.
[EXTERNAL_DOWNLOADS]: The skill configuration for web platforms involves fetching a standard JavaScript library from a well-known service.
Evidence: SKILL.md contains instructions to include a script tag referencing https://cdnjs.cloudflare.com/ajax/libs/pdf.js/4.10.38/pdf.min.mjs in the web/index.html file.

syncfusion-flutter-pdf-viewer