vercel-react-best-practices

Pass

Audited by Gen Agent Trust Hub on Sep 4, 2026

Risk Level: SAFEINDIRECT_PROMPT_INJECTIONDYNAMIC_EXECUTIONEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
  • [INDIRECT_PROMPT_INJECTION]: The skill establishes rules for agents to refactor and generate React/Next.js codebases.
  • Ingestion points: The agent is designed to process user-provided source code files (SKILL.md).
  • Boundary markers: The instructions do not define specific delimiters or warnings to disregard instructions potentially hidden in the target code being optimized.
  • Capability inventory: The agent uses file-writing and code-generation capabilities to apply these performance rules across the project.
  • Sanitization: No explicit logic for filtering user code for adversarial prompt patterns is included.
  • [DYNAMIC_EXECUTION]: The skill includes code templates for performance optimization that utilize dynamic execution patterns.
  • Evidence: Rule rendering-hydration-no-flicker.md provides a correct implementation example using dangerouslySetInnerHTML to inject a synchronous <script> block into the DOM for theme management. This is a recognized performance pattern in the Next.js ecosystem for preventing visual flicker.
  • [EXTERNAL_DOWNLOADS]: The instructions recommend several third-party libraries for specialized tasks.
  • Evidence: References include better-all (parallelizing partially dependent promises), lru-cache (cross-request caching), swr (client-side data fetching and revalidation), and zod (schema validation). All referenced packages are well-known and widely used within the professional web development community.
  • [COMMAND_EXECUTION]: The skill suggests the use of command-line utilities for asset optimization.
  • Evidence: Rule rendering-svg-precision.md recommends executing npx svgo to automate the reduction of coordinate precision in SVG files. This is a standard optimization utility.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 4, 2026, 06:53 AM
Security Audit — agent-trust-hub — vercel-react-best-practices