The Agent Skills Directory

[SAFE]: The skill acts as a technical reference for the wonder-image/app framework, providing instructions on architecture, bootstrap flows, and resource management. It contains clear security guidelines, such as using CSRF guards, SQL parameter binding, and proper input sanitization to ensure application integrity.- [SAFE]: All external references, including GitHub repositories and NPM packages, belong to the official wonder-image organization, which is the author of the skill and the framework. These are legitimate vendor resources.- [INDIRECT_PROMPT_INJECTION]: The skill defines surfaces for ingesting untrusted data through forms, API endpoints, and file imports (CSV/XLSX). However, it mandates robust security measures such as SvgSanitizer for uploads, automatic CSV formula escaping, and structured validation through the FormField hierarchy. These practices mitigate the risk of indirect injection attacks.
[SAFE]: The framework's scheduler and command execution features (e.g., proc_open) are well-documented with appropriate authentication and isolation constraints to prevent unauthorized use.

wi-app