The Agent Skills Directory

[Remote Code Execution] (HIGH): The skill instructs the user or agent to execute unverified remote code via npx -y next-devtools-mcp@latest. Running npx with the @latest tag from an unverified source allows the package owner to execute arbitrary code on the host machine.
Evidence: Found in SKILL.md under the 'Next.js DevTools MCP' section.
[Metadata Poisoning] (MEDIUM): The skill claims to support 'Next.js 16' and 'React 19.2' with a release date of 'November 2025'. As of current standards, these versions do not exist. This misleading metadata can cause an AI agent to attempt to implement non-existent APIs (e.g., cacheComponents: true or proxy.ts) or install non-existent packages, leading to system instability.
[Indirect Prompt Injection] (HIGH): The skill provides templates for handling external data (Firebase Storage uploads and Firestore database writes) and includes write capabilities via Server Actions without providing comprehensive sanitization logic.
Ingestion points: uploadImage in references/advanced-patterns.md, signUpAction in references/setup-guide-detailed.md.
Boundary markers: Absent. There are no instructions for the agent to treat user-provided data as untrusted when implementing these templates.
Capability inventory: setDoc (Firestore write), uploadBytes (Storage write), and npx (CLI execution).
Sanitization: Inconsistent; while one example uses Zod, others allow direct interpolation of user-controlled fields like displayName into database documents.
[External Downloads] (LOW): Instructs the download of numerous packages. While most are standard (e.g., firebase, @mui/material), the presence of unverified packages like next-devtools-mcp increases the risk profile.

nextjs-16-specialist