The Agent Skills Directory

[METADATA_POISONING]: The skill metadata in SKILL.md identifies the author as 'vercel' and claims the content is 'maintained by Vercel Engineering'. However, the deployment context identifies the author as 'alexdcd'. This impersonation is a deceptive practice intended to gain trust by misrepresenting the skill's source.
[INDIRECT_PROMPT_INJECTION]: The skill includes instructions that explicitly target AI agents ('This document is mainly for agents and LLMs to follow') to influence their logic during code generation and refactoring. Ingestion points: AGENTS.md and files in the rules/ directory. Boundary markers: Absent; the content is delivered as authoritative rules without isolation. Capability inventory: High-level access to code generation, file system writes, and automated refactoring. Sanitization: Absent; no validation or filtering is performed on the provided instructions.
[EXTERNAL_DOWNLOADS]: The documentation recommends the installation of third-party Node.js packages including better-all and lru-cache, which introduces external dependencies into the agent's environment.

vercel-react-best-practices