vercel-react-best-practices
Pass
Audited by Gen Agent Trust Hub on Sep 4, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONDYNAMIC_EXECUTIONEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill establishes rules for agents to refactor and generate React/Next.js codebases.
- Ingestion points: The agent is designed to process user-provided source code files (SKILL.md).
- Boundary markers: The instructions do not define specific delimiters or warnings to disregard instructions potentially hidden in the target code being optimized.
- Capability inventory: The agent uses file-writing and code-generation capabilities to apply these performance rules across the project.
- Sanitization: No explicit logic for filtering user code for adversarial prompt patterns is included.
- [DYNAMIC_EXECUTION]: The skill includes code templates for performance optimization that utilize dynamic execution patterns.
- Evidence: Rule
rendering-hydration-no-flicker.mdprovides a correct implementation example usingdangerouslySetInnerHTMLto inject a synchronous<script>block into the DOM for theme management. This is a recognized performance pattern in the Next.js ecosystem for preventing visual flicker. - [EXTERNAL_DOWNLOADS]: The instructions recommend several third-party libraries for specialized tasks.
- Evidence: References include
better-all(parallelizing partially dependent promises),lru-cache(cross-request caching),swr(client-side data fetching and revalidation), andzod(schema validation). All referenced packages are well-known and widely used within the professional web development community. - [COMMAND_EXECUTION]: The skill suggests the use of command-line utilities for asset optimization.
- Evidence: Rule
rendering-svg-precision.mdrecommends executingnpx svgoto automate the reduction of coordinate precision in SVG files. This is a standard optimization utility.
Audit Metadata