vercel-react-best-practices
Pass
Audited by Gen Agent Trust Hub on Sep 15, 2026
Risk Level: SAFEMETADATA_POISONINGEXTERNAL_DOWNLOADSDYNAMIC_EXECUTION
Full Analysis
- [METADATA_POISONING]: The skill's metadata and internal documentation claim that it is "maintained by Vercel Engineering" and originates "from Vercel Engineering." However, the skill is authored by an independent user (boraoztunc) rather than the official Vercel organization. This impersonation of a well-known brand is deceptive.
- [EXTERNAL_DOWNLOADS]: The skill's instructions and examples reference several external Node.js packages and technical resources. Evidence includes mentions of
better-all,lru-cache,swr,lucide-react, and@mui/material. These are all well-known, reputable packages in the JavaScript ecosystem, and the referenced domains (vercel.com, swr.vercel.app, github.com) are trusted services. - [DYNAMIC_EXECUTION]: The skill includes code examples that use
dangerouslySetInnerHTMLto inject a synchronous script for handling theme hydration inrules/rendering-hydration-no-flicker.md. This is a standard architectural pattern for Next.js to prevent layout shift and does not involve the execution of untrusted external code or user input.
Audit Metadata