The Agent Skills Directory

[SAFE]: The skill is entirely focused on providing architectural guidance and code patterns for Next.js performance optimization. It does not contain any malicious instructions or suspicious code patterns.
[COMMAND_EXECUTION]: The skill references standard development commands such as npm install and npm run build. These are documented as part of a legitimate development workflow for installing well-known packages like @next/bundle-analyzer and @vercel/analytics.
[REMOTE_CODE_EXECUTION]: No remote code execution vulnerabilities were found. All external dependencies listed are well-known, official packages within the Next.js and Vercel ecosystems.
[DATA_EXFILTRATION]: There is no evidence of sensitive data access or exfiltration. Code examples demonstrate the use of environment variables (e.g., process.env.OPENAI_API_KEY) for secret management, which is a standard security practice.
[PROMPT_INJECTION]: The skill does not contain instructions that attempt to override agent behavior, bypass safety filters, or reveal system prompts.
[INDIRECT_PROMPT_INJECTION]: While the skill describes patterns for processing external data (e.g., request.json() in API routes), it includes best practices for error handling and validation, minimizing the surface for indirect injection.

nextjs-performance