The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill references standard development dependencies from public registries including @json-render/mcp, @json-render/core, and @modelcontextprotocol/sdk. It also refers to the official GitHub repository for the json-render project at github.com/nichochar/json-render and the trusted Vercel Labs repository at github.com/vercel-labs/json-render for upstream synchronization.
[DATA_EXFILTRATION]: The skill contains specific security guidance in rules/sandbox-csp.md that instructs developers to implement minimal Content Security Policies. It explicitly warns against using wildcard origins (*) in connect-src or resource-src directives to prevent unauthorized data exfiltration from the sandboxed iframe environment.
[INDIRECT_PROMPT_INJECTION]: The architecture promoted by this skill mitigates prompt injection by using a structured, Zod-validated JSON catalog for UI generation. By strictly forbidding the return of raw HTML strings from MCP tools and instead requiring a typed component spec, it reduces the attack surface for malicious instruction injection via UI components.
[COMMAND_EXECUTION]: The documentation provides standard configuration examples for host applications like Claude Desktop and Cursor, which involve executing local Node.js scripts via node or npx to start the MCP server. These are standard operational procedures for the Model Context Protocol.

mcp-visual-output