The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill fetches UI component configurations from an external source at https://ui.inference.sh/r/chat.json using the npx shadcn@latest add command. It also references additional skills such as belt-sh/cli and inference-sh/skills@agent-ui. These downloads are consistent with the skill's stated purpose of providing a specialized UI library.
[INDIRECT_PROMPT_INJECTION]: The provided components (ChatInput, ChatMessage) define an ingestion surface for untrusted data from both end-users and AI agents, which is a standard characteristic of chat interfaces.
Ingestion points: Untrusted data enters the agent context through the ChatInput component (user messages) and is rendered via the ChatMessage component (agent responses) as seen in SKILL.md examples.
Boundary markers: The code snippets do not implement explicit boundary markers or instructions to ignore embedded commands within message content.
Capability inventory: The skill is restricted to UI rendering and does not include scripts that perform dangerous operations such as file system modifications, network exfiltration, or subprocess execution.
Sanitization: The components rely on default React rendering behaviors for XSS protection but do not include specific sanitization logic to detect or neutralize prompt injection patterns within the conversation flow.

chat-ui