The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill fetches documentation from 'https://nextjs.org/docs' and uses 'npx @next/codemod' to retrieve documentation helpers. These are official resources from Vercel/Next.js and are considered safe sources.
[REMOTE_CODE_EXECUTION]: The skill references 'npx skills add' commands to install official Vercel/Next.js skills. These operations target trusted repositories and are only suggested to the user, not executed automatically.
[COMMAND_EXECUTION]: The skill uses standard shell utilities such as 'find', 'grep', 'git', and 'sed' to perform project scanning, file inventory, and report path generation. These commands are necessary for its auditing functionality and do not involve unsanitized user input.
[INDIRECT_PROMPT_INJECTION]: As a code auditor, the skill processes untrusted source code which is a potential injection surface. However, it implements strict reporting rules requiring evidence in the form of 'file:line' citations and objective analysis, which mitigates the risk of the agent being misled by instructions embedded in the analyzed code.
[DATA_EXFILTRATION]: While the skill can read local source code and has access to 'WebFetch', its network operations are explicitly scoped to fetching official documentation. The optional Google Drive upload feature is gated by explicit user consent and follows a structured verification protocol.

nextjs-best-practices