The Agent Skills Directory

[PROMPT_INJECTION]: The skill documents code patterns that create a surface for indirect prompt injection and path traversal attacks.
Ingestion points: The uploadAvatar server action in references/server-actions.md processes formData from an external source (file upload).
Boundary markers: Absent. The instructions do not advise the agent to sanitize or validate the file metadata or content.
Capability inventory: The example uses fs/promises.writeFile to perform filesystem writes in references/server-actions.md and db.post.create for database mutations.
Sanitization: The provided file upload example is vulnerable to path traversal as it directly uses file.name in a path.join operation without sanitizing parent directory markers (e.g., ../).
[EXTERNAL_DOWNLOADS]: The skill instructions and deployment guides reference several external dependencies and tools.
Recommends installing the Vercel CLI via npm i -g vercel for deployment.
Utilizes the official node:20-alpine image in the multi-stage Dockerfile provided in references/deployment.md.
References standard libraries such as zod for validation and @vercel/analytics for monitoring.
These downloads originate from well-known services and trusted package registries.
[COMMAND_EXECUTION]: The deployment documentation includes standard CLI commands for build and deployment processes.
Includes build commands like npm run build and vercel --prod.
Provides docker-compose configurations and pm2 process management commands for self-hosting scenarios.

nextjs-developer