The Agent Skills Directory

[COMMAND_EXECUTION] (LOW): The skill contains a shell script scripts/validate-rsc-setup.sh which executes local commands to check project dependencies and versions.
Evidence: The script uses grep, node, and sed to parse package.json and tsconfig.json to verify Next.js, React, and AI SDK versions.
Risk: These are standard environment checks for a developer tool and operate only on local project metadata.
[DATA_EXPOSURE] (SAFE): While the patterns involve AI SDKs, they use standard environment variable patterns (e.g., openai('gpt-4o')) without hardcoding secrets or accessing sensitive system files.
[PROMPT_INJECTION] (LOW): The templates use user-provided strings directly in LLM prompts (e.g., messages: [{ role: 'user', content: prompt }]).
Risk: Standard risk for any AI-integrated application (Indirect Prompt Injection). The skill documentation explicitly recommends content sanitization using isomorphic-dompurify to mitigate XSS from AI-generated content.

generative-ui-patterns