The Agent Skills Directory

[SAFE]: The skill outlines a standard developer workflow for web application prototyping and does not contain any malicious instructions, obfuscated code, or unauthorized persistent mechanisms.
[EXTERNAL_DOWNLOADS]: The skill references official documentation and setup tools from well-known technology companies such as React (Meta), Next.js (Vercel), and Vue. These resources are standard for modern web development and are used appropriately within the skill's context for research and initialization.
[CREDENTIALS_UNSAFE]: The skill proactively addresses security by instructing the agent to never commit sensitive credentials and to use local environment files (.env.local) for managing API keys and secrets, following industry-standard safety practices.
[INDIRECT_PROMPT_INJECTION]: The skill defines an attack surface where it ingests untrusted user input such as application descriptions and feature requirements (found in SKILL.md). While it lacks explicit boundary markers or sanitization for these inputs, it maintains a capability inventory including local file system writes and shell command execution (npm install, build, test). This is characterized as a low security risk because it is inherent to the skill's function as a local code-generation tool and includes verification steps for critical paths.

vibe-coding