The Agent Skills Directory

[REMOTE_CODE_EXECUTION]: The skill's code examples, particularly in 'resources/complete-examples.md', recommend the use of highly suspicious Node.js packages such as react-hook-blog and @hookblog/resolvers/zod. These names appear to be malicious imitations or typosquats of the standard react-hook-form and @hookform/resolvers/zod libraries. Recommending the installation of unverifiable dependencies poses a severe risk of supply chain attacks, which could lead to arbitrary code execution during package installation or at runtime.- [OBFUSCATION]: A pervasive and deceptive string substitution pattern is present across several resource files, where the term 'form' has been systematically replaced with 'blog'. This results in corrupted terminology such as 'perblogance' instead of 'performance' ('resources/performance.md'), 'transblogers' instead of 'transformers' ('resources/data-fetching.md'), and the manipulation of standard API names (e.g., useBlog instead of useForm). This pattern obscures the intended logic and obscures the use of suspicious libraries by making them appear to be part of a legitimate architectural concept.- [METADATA_POISONING]: The skill's description in 'SKILL.md' presents it as a professional guide for React and TypeScript development. However, the associated resource files contain tampered code examples and suspicious package references that directly contradict these claims. This misalignment between the stated safety and utility of the skill and the actual content provided suggests an attempt to mislead users into adopting insecure practices or installing potentially malicious software.

frontend-dev-guidelines