The Agent Skills Directory

[DYNAMIC_EXECUTION]: In references/2023-11-07-turbo-frames-typeahead-search.md, the example code uses new RegExp with unsanitized user input from a search field to perform text highlighting. This could be exploited to cause a client-side Regular Expression Denial of Service (ReDoS) or unexpected UI behavior if a user enters specific regex control characters.- [INDIRECT_PROMPT_INJECTION]: The skill defines patterns for processing and rendering untrusted user data within the agent's operating context, which constitutes an injection surface.
Ingestion points: Search query inputs and form fields described in references/2023-11-07-turbo-frames-typeahead-search.md and references/2025-10-20-turbo-frames-typeahead-validation.md.
Boundary markers: None present in the provided HTML/ERB templates to distinguish between user-supplied data and developer-defined instructions.
Capability inventory: The skill utilizes DOM manipulation (e.g., innerHTML updates) and automated form submissions via requestSubmit().
Sanitization: While the documentation mentions backend sanitization, the client-side examples demonstrate direct innerHTML manipulation which is a common vector for Cross-Site Scripting (XSS) if not handled by the underlying framework's protections.- [EXTERNAL_DOWNLOADS]: The skill fetches JavaScript dependencies including @hotwired/turbo, @hotwired/stimulus, and es-module-shims from the ga.jspm.io CDN. These are well-known services for hosting NPM packages as ES modules.

hwc-forms-validation