The Agent Skills Directory

[METADATA_POISONING]: The skill uses deceptive branding, repeatedly claiming in its title, description, and footer to be authored by 'Vercel Engineering'. This contradicts the skill metadata identifying the author as 'dokhacgiakhoa'. This technique is used to increase perceived authority and trust through brand impersonation.
[INDIRECT_PROMPT_INJECTION]: The included auditing tool, scripts/react_performance_checker.py, ingests and processes content from external source files throughout a project directory.
Ingestion points: The script uses Path.rglob in check_waterfalls, check_barrel_imports, and other functions to read the content of all .ts, .tsx, .js, and .jsx files in a user-provided directory.
Boundary markers: None. The script reads raw file content directly into memory for processing.
Capability inventory: The script uses the re module for pattern matching and includes file read capabilities. It does not perform network operations or dynamic code execution in its current state.
Sanitization: None. The script performs no escaping or validation of the data read from project files.
[COMMAND_EXECUTION]: The skill provides two Python scripts, scripts/convert_rules.py and scripts/react_performance_checker.py, which are intended to be executed in a local environment. While the current code performs benign file operations and regex matching, the inclusion of standalone scripts in a documentation-oriented skill increases the risk of malicious code being introduced or executed on the local system.

nextjs-react-expert