The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill is designed to analyze and refactor React and Next.js source code provided by a user in the agent's context, creating an ingestion point for potentially malicious instructions embedded in user data.
Ingestion points: User-provided source code files (React components, Next.js pages) processed by the agent.
Boundary markers: None identified in the provided instructions to delimit user code from agent instructions.
Capability inventory: The agent is instructed to perform code generation, refactoring, and performance improvements based on the guide.
Sanitization: No specific sanitization or validation mechanisms are described for the input code.
[DYNAMIC_EXECUTION]: The skill documentation (specifically in rules/rendering-hydration-no-flicker.md) recommends the use of dangerouslySetInnerHTML to inject synchronous inline scripts for theme initialization and preference loading. While this is a common React pattern for performance, it represents a dynamic script execution vector.
[EXTERNAL_DOWNLOADS]: The skill references several external dependencies and resources in its guidelines and README, including:
better-all (Vercel Engineering public repository)
lru-cache (Well-known utility by Isaacs)
Various React ecosystem packages such as lucide-react, @mui/material, and swr.
These downloads are from trusted organizations or well-known services and do not escalate the verdict.
[COMMAND_EXECUTION]: The README.md file contains instructions for developers to execute shell commands such as pnpm install, pnpm build, and pnpm validate to manage the skill's build artifacts. These are standard development operations.

vercel-react-best-practices