The Agent Skills Directory

[COMMAND_EXECUTION]: Includes a utility bash script scripts/check-versions.sh that validates the local Node.js environment, project dependencies, and file structure using shell commands.
[EXTERNAL_DOWNLOADS]: Documentation and scripts facilitate the installation of packages from NPM and GitHub, targeting official repositories for Next.js and Vercel.
[PROMPT_INJECTION]: Detected Indirect Prompt Injection vulnerability surfaces within the provided code templates.
Ingestion points: Data entering the application through params, searchParams, and formData in templates like templates/app-router-async-params.tsx and templates/route-handler-api.ts.
Boundary markers: The templates do not include boundary markers or instructions to isolate untrusted data from the agent context.
Capability inventory: The skill's templates demonstrate capabilities for file system writes (fs/promises.writeFile) and raw HTML rendering (dangerouslySetInnerHTML).
Sanitization: Sanitization is absent in critical templates; the UPLOAD template in templates/route-handler-api.ts uses raw user-supplied filenames (file.name) in disk writes, creating a path traversal surface, and the BlogPostPage renders raw HTML content from an external API.

nextjs