The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill generates a UI for rendering documentation from markdown files. This creates a surface for Indirect Prompt Injection or Cross-Site Scripting (XSS) if the source documentation is untrusted. \n
Ingestion points: Documentation content is read from the local filesystem via the generated server API (references/templates/api-routes.ts) and passed to the frontend for rendering. \n
Boundary markers: The generated templates do not include specific delimiters or instructions to ignore embedded commands in the processed markdown. \n
Capability inventory: The generated UI components use dangerouslySetInnerHTML for rendering in several templates. \n
Sanitization: While the skill recommends using reputable libraries like @uiw/react-markdown-preview, the provided demo and fallback code in references/templates/mermaid-markdown.tsx uses dangerouslySetInnerHTML with a basic regex-based parser that does not sanitize HTML, potentially allowing malicious scripts to execute if present in the markdown content.
[DYNAMIC_EXECUTION]: The skill includes documentation and implementation patterns for MDX support, which involves executing code derived from documentation files at runtime. \n
Evidence: The SKILL.md file provides code snippets for using @mdx-js/mdx to compile and run markdown content as React components, which is a form of dynamic execution.
[COMMAND_EXECUTION]: The skill instructions and templates include standard command-line operations for project setup and development workflows. \n
Evidence: Mentions of pnpm add, npm install, and git commands for dependency management and search indexing (pagefind).
[EXTERNAL_DOWNLOADS]: The skill references and encourages the use of various third-party libraries and documentation from well-known sources. \n
Evidence: References to official repositories and packages from trusted organizations including Vercel (Streamdown), Remotion, and Adobe (React Aria).

tl-docs-viewer-create