The Agent Skills Directory

[DATA_EXPOSURE]: The skill documents best practices for environment variable management, using placeholders like DATABASE_URL and NEXTAUTH_SECRET and recommending the use of non-committed .env.local files and platform-specific secret management (e.g., @database-url).
[UNVERIFIABLE_DEPENDENCIES]: The skill references standard industry tools and libraries such as the Vercel CLI (vercel), @next/bundle-analyzer, zod, swr, and Sentry. These are all well-known, legitimate tools within the Next.js ecosystem.
[INDIRECT_PROMPT_INJECTION]: The skill provides patterns for handling user-supplied data through Server Actions (formData) and dynamic routes (params). 1) Ingestion points: Untrusted data enters the agent context through formData in references/server-actions.md and dynamic params in references/app-router.md. 2) Boundary markers: The skill recommends using Zod schema validation to delimit data. 3) Capability inventory: The skill includes file system writes (references/server-actions.md), database operations (references/data-fetching.md), and network fetching (references/data-fetching.md). 4) Sanitization: Demonstrates zod.safeParse for validation, though a file upload example lacks explicit path sanitization.
[DYNAMIC_EXECUTION]: Includes a boilerplate example for file uploads in references/server-actions.md using Node.js fs/promises. While limited to a specific folder in the example, this demonstrates a capability for interacting with the local file system using external metadata.

nextjs-developer