The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill documents features that ingest untrusted data, which is a potential surface for indirect prompt injection.
Ingestion points: File uploads via the enableAttachments property (referenced in references/attachments.md) and external AI service responses (referenced in references/ai-integration.md).
Boundary markers: The documentation provides best practices recommending the use of explicit delimiters and prompt engineering to ignore embedded instructions.
Capability inventory: The component can perform network requests to AI APIs and render complex UI elements through generative UI tools.
Sanitization: The documentation explicitly recommends using DOMPurify to sanitize HTML content before rendering user-provided or AI-generated strings.
[DYNAMIC_EXECUTION]: The skill includes a registerToolUI method that allows developers to define custom UI components using templates and JavaScript handler functions (referenced in references/generative-ui.md). This is a standard extensibility feature for UI frameworks and is documented with instructions on how to manage props and event listeners safely.
[EXTERNAL_DOWNLOADS]: The documentation references several external resources and endpoints:
Packages: Standard Syncfusion NPM packages like @syncfusion/ej2-vue-interactive-chat and associated theme packages.
Endpoints: Legitimate file upload demonstration services hosted on services.syncfusion.com and official API endpoints for OpenAI, Google Gemini, and Anthropic Claude.
[CREDENTIALS_UNSAFE]: Code examples for AI integration use environment variables (e.g., process.env.VUE_APP_OPENAI_KEY) or clearly marked placeholders (e.g., sk-xxxxxxxxxxxxxxxxxx), which aligns with secure development practices.

syncfusion-vue-ai-assistview