The Agent Skills Directory

[DYNAMIC_EXECUTION]: The script scripts/audit-next-build-contract.mjs utilizes the dynamic import() statement to load the target project's next.config.mjs file. This action evaluates code from the repository being analyzed within the agent's execution environment.
[DYNAMIC_EXECUTION]: The script scripts/overlay-geometry-probe.mjs generates a JavaScript code expression as a string (buildOverlayProbeExpression) which is designed to be executed in a browser context via a page-evaluation API to measure UI elements.
[COMMAND_EXECUTION]: The scripts scripts/run-build-memory-probe.mjs and scripts/smoke-next-standalone.mjs use the spawn function to run shell commands. These commands are extracted from project manifests or CLI arguments and are used to perform application builds and start local servers for smoke testing.
[INDIRECT_PROMPT_INJECTION]: This category identifies the attack surface where a repository could influence agent behavior through maliciously crafted project files. The skill ingests multiple untrusted files including package.json, repository manifests, and source code to determine build boundaries and performance instructions.
Ingestion points: Project manifests (config.yaml), package.json, and dynamic imports of project configuration files located in the target workspace.
Boundary markers: The skill emphasizes the use of structured data and strictly follows schemas such as nextjs-build-contracts.v1 and nextjs-overlay-contracts.v1 to parse repository data.
Capability inventory: The skill executes subprocesses for building and testing, performs local file system reads and writes (for auditing and instructions caching), and makes local network requests during smoke tests.
Sanitization: The scripts consistently use a resolveInside validation helper to ensure that file path resolution remains within the workspace root, effectively mitigating path traversal risks.

nextjs-application-performance