The Agent Skills Directory

[Indirect Prompt Injection Surface]: The skill includes utilities like buildUserPrompt and experimental_composeSpec that aggregate user-supplied prompts, application state, and element descriptions to construct instructions for an AI evaluator. This creates a potential surface where untrusted data could attempt to influence the agent's behavior.
Ingestion points: User-provided prompt strings, initialState values, and candidate element descriptions in SKILL.md.
Capability inventory: The evaluator selects UI components, determines their hierarchy, and manages state bindings via the @json-render/core runtime.
Sanitization: The documentation does not specify internal sanitization for these inputs; it is recommended that developers validate and delimit external content before passing it to these builders.
Boundary markers: The skill uses [built-in] markers for some actions, which helps distinguish them in prompts, though this is not a complete mitigation against adversarial pressure.
[Dynamic Expression Resolution]: The framework supports dynamic prop expressions like $computed, $state, and $template which are resolved at render time.
Context: While these are core features for the intended UI rendering functionality, they involve calling registered functions and interpolating state values. Security depends on ensuring that only authorized functions are registered for $computed and that state paths are correctly scoped.
[Standard Secret Management]: The skill instructs the use of environment variables (process.env.AI_GATEWAY_API_KEY) for managing sensitive credentials. This aligns with standard security best practices for secret handling and avoids hardcoding sensitive information.

core