The Agent Skills Directory

[CREDENTIALS_UNSAFE]: The authentication helper in templates/api/_lib/auth.js contains a hardcoded fallback secret string ('dev-insecure-secret'). This secret is used to sign session cookies if the SESSION_SECRET and ADMIN_PASSWORD environment variables are not provided. Relying on a known hardcoded secret for session management is a security weakness.
[COMMAND_EXECUTION]: The skill involves the execution of shell commands for package management (npm install, bun add) and storage provisioning (vercel storage create) as part of the setup process.
[EXTERNAL_DOWNLOADS]: The skill downloads and installs external dependencies, specifically react-router-dom and @vercel/blob. These are well-known packages from trusted sources.
[PROMPT_INJECTION]: The CMS architecture creates an attack surface for indirect prompt injection by allowing the storage and rendering of arbitrary data.
Ingestion points: Untrusted data enters the agent context via the /api/content endpoint, which reads from Vercel KV or Blob storage (see templates/api/_lib/store.js).
Boundary markers: The skill lacks explicit boundary markers or instructions to ignore embedded commands within the content store.
Capability inventory: The skill possesses capabilities to write files and execute subprocesses during the installation phase.
Sanitization: Content is parsed as JSON but lacks specific sanitization or filtering to prevent LLM-based injection attacks.
[DATA_EXFILTRATION]: The skill includes instructions for managing sensitive credentials through environment variables and correctly advises on using .gitignore to prevent their exposure in version control.

vercel-inline-cms