The Agent Skills Directory

[DYNAMIC_EXECUTION]: The skill describes a library feature where CLICK navigation rows execute arbitrary JavaScript strings via the new Function() constructor.
Evidence: Found in SKILL.md: "A CLICK row's event is a string of JavaScript, compiled with new Function(event) and called with no arguments."
[INDIRECT_PROMPT_INJECTION]: The navItems configuration structure serves as a potential injection surface if the data used to populate the event field is sourced from untrusted inputs.
Evidence:
Ingestion points: The navItems property of the FullLayout component documented in SKILL.md.
Boundary markers: None specified for the input data within the documented component.
Capability inventory: The event field allows for arbitrary JavaScript execution via new Function as described in SKILL.md.
Sanitization: The skill explicitly warns users: "Because the string is executed verbatim, whoever can write the row can run script in the page. Keep that column administrator-only, and never populate it from anything an end user can set."
[COMMAND_EXECUTION]: The instructions include standard package management commands for installing the layout library.
Evidence: Found in SKILL.md: npm view @devopsnext/starterkit-layout version and pnpm add @devopsnext/starterkit-layout@1.4.1.

starterkit-layout