vercel-react-best-practices
Pass
Audited by Gen Agent Trust Hub on Sep 14, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill is designed to analyze and refactor user-provided source code, which serves as an ingestion point for untrusted data. 1. Ingestion points: React components and Next.js pages provided by the user for performance review or refactoring (specified in SKILL.md). 2. Boundary markers: Absent. The skill does not implement delimiters or specific instructions to ignore directives potentially embedded in the source code. 3. Capability inventory: The skill assumes the ability to read and write to the local file system and execute project scripts such as pnpm build or pnpm validate. 4. Sanitization: Absent. There are no defined mechanisms to sanitize or validate the content of the ingested source code.
- [EXTERNAL_DOWNLOADS]: The skill references several external Node.js packages and remote repositories for its functionality. Evidence: Rule files and the README.md reference dependencies like better-all and lru-cache, and instruct the user to run pnpm install. These resources originate from well-known and trusted sources.
Audit Metadata