The Agent Skills Directory

[COMMAND_EXECUTION]: The server action example for file uploads in references/server-actions.md is vulnerable to path traversal. It uses file.name from untrusted input directly in path.join(process.cwd(), 'public', 'uploads', file.name) without any sanitization, which could allow a malicious actor to overwrite arbitrary files on the server.
[SAFE]: The deployment documentation in references/deployment.md follows security best practices by recommending the Authorization header for revalidation secrets instead of query parameters.
[SAFE]: The skill correctly identifies the risks of using dangerouslySetInnerHTML and recommends using sanitization libraries like DOMPurify.
[SAFE]: The skill references industry-standard and trusted tools from providers such as Vercel, Prisma, and Sentry.

nextjs-developer