The Agent Skills Directory

[OBFUSCATION]: The skill employs a systematic text substitution technique where the string 'form' is replaced with 'blog'. This extends beyond variable names to standard English words and library imports, potentially intended to evade security scanners looking for form-related operations.
Evidence: The word 'performance' is consistently replaced with 'perblogance' in section headers and checklists within resources/complete-examples.md and resources/performance.md.
Evidence: 'transformations' and 'transformers' are written as 'transblogations' and 'transblogers' in resources/file-organization.md.
Evidence: The standard HTML tag <form> is replaced with a custom <blog> tag in code examples in resources/complete-examples.md.
[EXTERNAL_DOWNLOADS]: The skill instructions promote the use of non-standard and unverifiable software packages that mimic the naming convention and API of established libraries.
Evidence: References to react-hook-blog and @hookblog/resolvers instead of the industry-standard react-hook-form and @hookform/resolvers in resources/complete-examples.md. This is a pattern indicative of typosquatting.
[METADATA_POISONING]: The skill metadata includes a high-risk flag without clear justification, which may be used to mislead automated evaluation systems.
Evidence: The frontmatter in SKILL.md labels the risk as 'critical' despite the content being ostensibly standard frontend development guidelines.
[INDIRECT_PROMPT_INJECTION]: The skill defines a large attack surface by instructing the agent to process and generate complex frontend code based on user inputs without providing guidance on sanitization or output validation.
Evidence: Architectural guidelines in SKILL.md lack security best practices for handling untrusted data. The ingestion point is the user's prompt for component creation, boundary markers are absent, and capabilities include data mutation via generated API services.

frontend-dev-guidelines