The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill instructs the agent to fetch JavaScript libraries (Chart.js and Mermaid.js) from well-known and trusted Content Delivery Networks (CDNs) including Cloudflare (cdnjs.cloudflare.com), jsDelivr (cdn.jsdelivr.net), unpkg (unpkg.com), and esm.sh.
[COMMAND_EXECUTION]: The skill templates guide the agent to generate and execute HTML and JavaScript within the platform's sandbox (show_widget tool). This includes event handlers like onclick and data-driven chart rendering, which are the primary intended functions of the skill.
[DYNAMIC_EXECUTION]: The skill involves the dynamic generation of UI code strings that are executed in the browser. The templates use standard libraries and follow best practices for script loading (e.g., using onload handlers and checking globals) to ensure reliable execution of generated components.
[INDIRECT_PROMPT_INJECTION]: The skill uses the sendPrompt function, which allows interactive widgets to trigger follow-up actions from the AI agent. This creates a standard interaction surface common to UI-based AI skills.
Ingestion points: Untrusted user data intended for visualization in charts or diagrams (found in SKILL.md).
Boundary markers: Instructions explicitly separate visual tool output from explanatory response text to maintain clear boundaries.
Capability inventory: The skill utilizes the show_widget tool for rendering and the sendPrompt function for conversational feedback.
Sanitization: The skill relies on the AI's standard formatting capabilities; no additional programmatic sanitization is specified for the widget templates.

generative-ui