The Agent Skills Directory

[Prompt Injection] (SAFE): The skill contains no instructions designed to override agent behavior, bypass safety guardrails, or reveal internal system prompts. All instructions are focused on architectural guidelines.
[Data Exposure & Exfiltration] (SAFE): No hardcoded secrets, API keys, or sensitive file paths were found. Network operations in examples (e.g., fetch calls to /api/users) are standard placeholders and do not target malicious domains.
[Obfuscation] (SAFE): All content is human-readable. There is no use of Base64 encoding, zero-width characters, or homoglyphs to hide malicious payloads.
[Unverifiable Dependencies & Remote Code Execution] (SAFE): The skill does not perform any package installations or remote script executions. It references standard, trusted libraries like 'zustand', 'immer', and 'lodash'.
[Privilege Escalation] (SAFE): No use of sudo, chmod, or other administrative commands that would indicate an attempt to elevate permissions.
[Persistence Mechanisms] (SAFE): The skill does not attempt to modify system startup files, cron jobs, or registry keys to establish persistence.
[Metadata Poisoning] (SAFE): Metadata fields in SKILL.md and metadata.json are accurate and align with the stated purpose of the skill.
[Indirect Prompt Injection] (SAFE): Although the skill is intended to process untrusted code for review, it does not have the capability to execute commands or write to the filesystem, neutralizing the risk of injection-based exploitation.
[Dynamic Execution] (SAFE): The examples provided use standard TypeScript patterns. No unsafe use of eval(), exec(), or dynamic library loading was found.

zustand