The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill defines a framework for ingesting and processing untrusted Markdown content, which creates a potential surface for indirect prompt injection or XSS if not handled correctly.
Ingestion points: The skill uses parseMarkdown and renderHtml to process external source strings in several code examples within SKILL.md.
Boundary markers: The documentation explicitly mentions 'explicit trusted boundaries' for HTML output and notes that while standard nodes are escaped, custom extension strings are trusted by the renderer.
Capability inventory: The skill enables custom extensions to modify the document AST and generate raw HTML strings, which could be exploited if malicious input influences the output.
Sanitization: Standard nodes are escaped via context.renderBlock, but the skill places the responsibility for sanitizing custom HTML hooks on the developer, as evidenced in the 'Rich output versus untrusted-content safety' section.

custom-extensions