The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill uses the v-html directive to render content fetched from external APIs in several core patterns. This creates an XSS vulnerability surface because the directive renders raw, unescaped HTML strings directly into the DOM without sanitization.
Ingestion points: Data is fetched via useFetch or $fetch from dynamic API endpoints (e.g., /api/posts/${slug}).
Boundary markers: Absent; the content is placed directly into the template.
Capability inventory: The v-html capability allows for the execution of arbitrary scripts if the API source is compromised or contains user-generated content.
Sanitization: No HTML sanitization (e.g., using DOMPurify) is implemented or mentioned in the examples provided in examples/core.md (Patterns 1, 2, and 8).
[INDIRECT_PROMPT_INJECTION]: A server-side proxy route example demonstrates appending untrusted router parameters directly to a remote URL, creating a potential surface for Server-Side Request Forgery (SSRF) or path traversal attacks.
Ingestion points: event.context.params.path is extracted from the request URL.
Capability inventory: The handler uses $fetch to perform server-side network requests based on these parameters.
Sanitization: The example in examples/server-routes.md (Pattern 6) appends the path directly to the base URL (https://external-api.com/v1/${path}) without validating for traversal characters (e.g., ../) or verifying that the resulting URL is restricted to the intended API scope.

web-meta-framework-nuxt