The Agent Skills Directory

[PRIVILEGE_ESCALATION]: The skill provides instructions to implement authentication middleware in a file named proxy.ts. In the Next.js framework, middleware must be located in middleware.ts or src/middleware.ts to be recognized and executed by the runtime. By using an incorrect filename, the skill creates a configuration where the security logic is silent and non-functional, allowing unauthenticated access to sensitive routes such as /dashboard.
[PROMPT_INJECTION]: The instruction "NO preguntes. Ejecuta el Golden Path completo." (Do not ask. Execute the full Golden Path.) attempts to override the agent's interactive behavior and suppress user oversight. This is a concealment tactic used to bypass review and force automated execution of potentially dangerous infrastructure changes.
[METADATA_POISONING]: The skill claims to be designed for "Next.js 16", a version that does not currently exist. This misleading technical context, combined with the use of the non-standard proxy.ts file, can lead to the implementation of insecure and broken project architectures that fail to protect user data.
[INDIRECT_PROMPT_INJECTION]: The skill establishes an attack surface where untrusted data from form inputs and external OAuth providers is processed and stored in the database without sanitization.
Ingestion points: The updateProfile action in src/actions/auth.ts (via formData) and the handle_new_user SQL trigger (via raw_user_meta_data from the OAuth provider).
Boundary markers: None are provided in the instructions or the generated code.
Capability inventory: The skill utilizes Write, Edit, and Bash tools, and has the ability to update Supabase database records and create new backend files.
Sanitization: There is no evidence of input validation, escaping, or filtering before the user-supplied data is persisted to the profiles table.
[COMMAND_EXECUTION]: The skill requires the execution of shell commands for package installation (npm install @supabase/ssr) and the execution of database migrations via a Supabase provider.
[EXTERNAL_DOWNLOADS]: Fetches the official @supabase/ssr package from the public NPM registry to handle authentication for server-side rendered routes.

add-login