The Agent Skills Directory

[SAFE]: The skill serves as a technical security review checklist and does not contain any executable malicious code.
[PROMPT_INJECTION]: No attempts to override agent instructions, bypass safety filters, or extract system prompts were found.
[CREDENTIALS_UNSAFE]: The skill uses safe placeholders for secrets (e.g., 'sk-proj-xxxxx', 'password123') within educational 'NEVER Do This' sections and correctly instructs users to use environment variables for real secrets.
[EXTERNAL_DOWNLOADS]: No suspicious remote downloads or untrusted external scripts are referenced. All referenced resources (OWASP, Next.js, Supabase) are well-known, trusted industry sources.
[COMMAND_EXECUTION]: No dangerous shell command execution patterns detected. The mentioned CLI tools (e.g., 'npm audit', 'git add') are standard development practices.
[DATA_EXFILTRATION]: No network exfiltration or sensitive file access patterns were identified. The network code examples provided (e.g., CSP headers, rate limiting) are for defensive configuration purposes.
[OBFUSCATION]: The content is entirely plain-text markdown with no hidden characters, encoded payloads, or homoglyph attacks.
[DYNAMIC_EXECUTION]: The skill does not generate or execute dynamic code at runtime. It focuses on static code patterns and configuration best practices.

security-review