The Agent Skills Directory

[REMOTE_CODE_EXECUTION]: Identification of suspicious third-party dependency patterns in resources/complete-examples.md. Several code examples (specifically Example 5 and Example 5 duplicated) reference non-standard packages react-hook-blog and @hookblog/resolvers, and use non-standard HTML-like tags such as <blog>. These references strongly resemble typosquats of the popular react-hook-form and @hookform/resolvers libraries. Guiding developers to use these packages in a production environment could lead to the installation and execution of untrusted or malicious code.
[INDIRECT_PROMPT_INJECTION]: The skill facilitates the generation of complex frontend components and features based on user-provided requirements, creating a potential surface for indirect injection if user data is processed without sufficient boundaries.
Ingestion points: User-provided specifications for creating components, pages, and features across multiple frameworks (SKILL.md).
Boundary markers: Absent. The skill lacks specific instructions or delimiters to help the agent distinguish between architectural requirements and embedded malicious instructions in user input.
Capability inventory: The suggested code patterns involve apiClient (axios) for network requests, data fetching with useSuspenseQuery, and authentication state access via useAuth (resources/common-patterns.md, resources/data-fetching.md).
Sanitization: Absent. There are no instructions for validating or sanitizing user-provided logic or identifiers before they are incorporated into generated component code.

frontend-development