The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill defines a Rich Text Editor (WYSIWYG) interface that processes and outputs HTML data.
Ingestion points: Untrusted content enters via the initialValue prop and is processed by the editor instance in references/react-mount.md.
Boundary markers: The skill does not use specific delimiters but provides clear warnings to the developer about the trust boundary.
Capability inventory: The code provided is limited to standard DOM operations (appendChild, replaceChildren) and editor configuration; it does not contain network, file system, or subprocess execution capabilities.
Sanitization: The skill includes explicit security instructions in SKILL.md (Security boundary section) recommending the use of DOMPurify for sanitizing editor output and demonstrates the use of attributeBlacklist (blocking onerror) in its configuration examples.
[SAFE]: The skill demonstrates secure development practices, such as using dynamic imports (import('suneditor')) to prevent server-side execution of browser-only code and utilizing cleanup functions in React effects to properly destroy editor instances and prevent memory leaks.

suneditor-v3