The Agent Skills Directory

[COMMAND_EXECUTION]: The file upload implementation in references/server-actions.md is vulnerable to path traversal. The uploadAvatar function uses the file.name property directly within a path.join() call without validation, allowing an attacker to specify a path like ../../.env to overwrite critical system or configuration files.- [CREDENTIALS_UNSAFE]: The docker-compose.yml configuration template in references/deployment.md includes hardcoded default credentials (POSTGRES_PASSWORD=postgres). Providing these defaults in a deployment context without explicit warnings to change them creates a risk of insecure deployments.- [DATA_EXFILTRATION]: In references/server-actions.md, a vulnerability surface exists where untrusted data influences file system operations. 1. Ingestion points: file.name from formData.get('avatar'). 2. Boundary markers: Absent for filename processing. 3. Capability inventory: writeFile in references/server-actions.md. 4. Sanitization: Absent, directly interpolating user-controlled strings into file paths.

nextjs-developer