The Agent Skills Directory

[SAFE]: The skill provides documentation and examples for rendering UI components from structured JSON. No malicious patterns, obfuscation, or unauthorized access attempts were detected.
[EXTERNAL_DOWNLOADS]: The skill uses npx shadcn@latest add to fetch a UI registry configuration from ui.inference.sh. This is a standard method for scaffolding components in React/Next.js environments from a vendor-provided registry.
[INDIRECT_PROMPT_INJECTION]: The skill's primary purpose is to render rich UIs based on structured agent responses (JSON). This creates an attack surface where untrusted data could influence the UI layout or actions.
Ingestion points: The widget prop in the WidgetRenderer component accepts JSON structures that define the UI.
Boundary markers: None explicitly defined in the documentation snippets.
Capability inventory: The rendered UI can include forms, buttons with onClickAction, and inputs, which could be used to facilitate phishing or unauthorized actions if the JSON source is compromised.
Sanitization: The skill documentation does not specify sanitization methods, though standard React rendering provides baseline protection against XSS. Developers should ensure the JSON source is trusted or validated before rendering.

widgets-ui