The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The validation script ingests untrusted content from a project's package.json and reflects it directly into the agent's context through the generated report. An attacker could provide a malicious package.json with a crafted version string containing prompt injection instructions.
Ingestion points: The check_next_version function in scripts/validate.py reads the 'next' dependency version string from package.json.
Boundary markers: The validation report does not use delimiters to wrap the reflected version string, making it indistinguishable from valid instructions.
Capability inventory: The validator script is limited to read-only static analysis and string matching; it possesses no network, file-write, or code-execution capabilities.
Sanitization: The extracted version string is printed to the report without sanitization or validation.
[METADATA_POISONING]: The skill's documentation and internal validation logic are designed around 'Next.js 16' and a mandatory 'proxy.ts' file, which do not exist in the current stable Next.js framework (v15 is the current release). This metadata is deceptive and provides misleading instructions to both the agent and the user regarding framework requirements.

nextjs-validator