The Agent Skills Directory

[SAFE]: The skill follows security best practices for secret management, strictly using environment variables for credentials and providing specific instructions to generate secure, cryptographically random strings for authentication secrets.
[SAFE]: Proactive security warnings are included regarding third-party agent instructions that may be automatically injected by platform integrations (e.g., Neon on Vercel). The skill instructs the agent to notify the user, review differences, and seek explicit consent before committing such files.
[COMMAND_EXECUTION]: The skill utilizes established CLI tools such as vercel, gh, and pnpm for infrastructure provisioning and project setup. These commands are executed with clear intent and described to the user in plain language, avoiding silent or unexpected operations.
[INDIRECT_PROMPT_INJECTION]: A design extraction feature ingests data from user-provided URLs. The risk is mitigated by constraining the agent to extract only specific computed CSS properties (colors, fonts, radii) and explicitly forbidding the reproduction of layout, copy, or identity assets from external sources.
[DYNAMIC_EXECUTION]: The skill generates local TypeScript scripts for database seeding and local server management. These scripts are standard development artifacts and use well-known libraries from official registries without executing untrusted remote code.
[EXTERNAL_DOWNLOADS]: Dependencies are restricted to reputable packages from the npm registry. The skill includes an optional recommendation for an external design utility on GitHub, which is presented as a manual choice for the developer rather than a hidden background installation.

start-an-app