The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill is designed to process external code provided for refactoring or review, creating an attack surface for indirect prompt injection.
Ingestion points: Codebases, components, and pages provided by users for optimization (referenced in SKILL.md).
Boundary markers: No specific delimiters or "ignore instructions" warnings are suggested for the agent to use when evaluating external code.
Capability inventory: The skill guides the agent to generate code involving data fetching (network operations) and state management (file/storage access).
Sanitization: No guidelines are included for sanitizing user-supplied data that might be interpolated into the suggested code patterns.
[DYNAMIC_EXECUTION]: One of the recommended best practices involves using potentially unsafe React props to inject scripts.
Evidence: The rule rendering-hydration-no-flicker.md suggests using dangerouslySetInnerHTML={{ __html: ... }} to inject a theme-detection script.
Context: While this is a standard industry pattern for preventing hydration flicker in Next.js, it represents a dynamic execution vector that could be exploited if the injected content is not strictly static.
[METADATA_POISONING]: The skill uses branding that could be interpreted as official, though it is published by a third-party author.
Evidence: The skill is named vercel-react-best-practices and the description in SKILL.md states it is "from Vercel Engineering," while the author is listed as davila7.
Context: The README.md clearly attributes the original content to Shu Ding at Vercel, indicating this is likely a community-packaged version of public guidelines rather than a deceptive impersonation attempt.
[EXTERNAL_DOWNLOADS]: The skill recommends several third-party dependencies and references external documentation from well-known sources.
References: Recommends packages like better-all (by a Vercel engineer), lru-cache, and swr (a Vercel-maintained library).
Trust Scope: All referenced domains (vercel.com, nextjs.org, react.dev) and GitHub repositories are established and reputable sources within the web development community.

vercel-react-best-practices