vercel-react-best-practices

SUSPICIOUS: the skill’s stated purpose is benign documentation, and no credential theft, exfiltration, or dangerous execution behavior appears in the provided content. However, the claimed Vercel authorship does not match the advertised installation source, which is a third-party GitHub repo installed through an official but unpinned CLI, so the main issue is provenance and supply-chain trust rather than confirmed malware.