The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill's documentation and code examples promote the use of the react-hook-blog package and @hookblog/resolvers/zod extension. These are not standard or recognized libraries in the React ecosystem and appear to be typosquatted versions of the widely used react-hook-form and @hookform/resolvers packages. This introduces a supply chain risk for developers who incorporate these templates into their projects.
[OBFUSCATION]: The skill exhibits a systematic string substitution pattern where the word "form" is replaced with "blog" in multiple technical terms and code elements across several files. Examples include the terms perblogance (performance), transblogers (transformers), blogState (formState), and the use of a non-standard <blog> HTML tag in place of the standard <form> tag. This pattern is characteristic of an adversarial attempt to normalize the use of suspicious, likely malicious, dependencies by altering common terminology.
[REMOTE_CODE_EXECUTION]: By instructing users to install and execute code from unverified and likely malicious packages like react-hook-blog, the skill facilitates a path for remote code execution on the user's development machine or within their deployed applications.

frontend-dev-guidelines