The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill references and utilizes official packages from Vercel, specifically @vercel/kv, which is a recognized and trusted industry provider. These dependencies are version-pinned and retrieved from official registries.
[CREDENTIALS_UNSAFE]: The documentation correctly identifies the security risks of hardcoding secrets and provides explicit instructions for managing sensitive API tokens and URLs using environment variables and .env.local files, ensuring they are not committed to source control.
[INDIRECT_PROMPT_INJECTION]: The skill manages untrusted data such as user IP addresses and session metadata. An analysis of the injection surface shows:
Ingestion points: User IP addresses retrieved from request headers and session data stored in KV (found in templates/simple-rate-limiting.ts and templates/session-management.ts).
Boundary markers: While explicit delimiters for Redis key interpolation are not shown in the templates, the usage patterns follow standard key-value storage conventions.
Capability inventory: The skill is limited to standard Redis operations via the @vercel/kv client and cookie management via next/headers.
Sanitization: Data is serialized using JSON.stringify before storage, which prevents raw input from being executed or interpreted as instructions by the underlying storage engine.
[SAFE]: The shell scripts and templates provided are boilerplate examples with no evidence of obfuscation, persistence mechanisms, privilege escalation, or malicious command execution. All external links point to official Vercel documentation or legitimate GitHub issue trackers.

vercel-kv