The Agent Skills Directory

[DATA_EXPOSURE_&_EXFILTRATION]: The skill documents patterns for accessing URL query parameters via router.query. While this involves processing user-controlled input (e.g., email addresses or return URLs), the skill emphasizes best practices such as type checking (typeof query.param === 'string') and validation before use, which mitigates risks of data misuse.
[COMMAND_EXECUTION]: The skill demonstrates programmatic navigation using router.push() and router.replace(). These are standard framework operations for client-side routing and do not involve shell command execution or system-level privileges.
[PROMPT_INJECTION]: Analysis of the documentation and examples shows no attempts to override agent behavior, bypass safety filters, or extract system prompts. The instructions are strictly technical and focused on React/Next.js implementation details.
[INDIRECT_PROMPT_INJECTION]: The skill describes a surface where untrusted data (URL parameters) is ingested into the application context.
Ingestion points: router.query is accessed in multiple examples across SKILL.md and references/examples.md.
Boundary markers: Not explicitly defined for prompt delimiters, but the skill recommends using structured objects and type guards.
Capability inventory: The agent is instructed to perform navigation (router.push) and analytics tracking based on route state.
Sanitization: The patterns strongly encourage type validation and custom validation logic (e.g., isEmailValid) before processing external input.

nextjs-routing