The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill documents an attack surface where the agent processes untrusted external data.
Ingestion points: Data enters the system via FormData in Server Actions (createUser) and JSON request bodies in API Routes (POST to /api/users).
Boundary markers: None identified in the provided code snippets.
Capability inventory: The skill uses bun:sqlite for database writes and Bun.write for local filesystem persistence in app/api/files/route.ts.
Sanitization: The implementation correctly uses parameterized SQL queries (db.run(..., [name])) which mitigates typical SQL injection risks.
[COMMAND_EXECUTION]: The skill provides instructions for the user or agent to execute shell commands to manage the project lifecycle.
Evidence includes initialization commands (bunx create-next-app), dependency management (bun install), and deployment operations using the vercel CLI.
[EXTERNAL_DOWNLOADS]: The skill utilizes standard package managers and scaffolding tools to fetch external code.
It instructs the use of bunx create-next-app@latest and bun install to download dependencies from public registries.
It appropriately mentions supply chain security measures such as version pinning and using the Socket security CLI for package auditing.

bun-nextjs