vercel-ai-sdk-security-scan
Pass
Audited by Gen Agent Trust Hub on Sep 30, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill serves a defensive purpose, providing a rule set for auditing Vercel AI SDK implementations for common security pitfalls. No malicious code or hidden behaviors were found in the skill's own instructions.
- [INDIRECT_PROMPT_INJECTION]: The skill has an indirect prompt injection attack surface as it is designed to analyze user-provided source code. 1. Ingestion points: The skill analyzes user-provided route handlers and tool definitions mentioned in the instructions. 2. Boundary markers: The skill does not define explicit delimiters to separate analyzed code from agent instructions. 3. Capability inventory: The skill defines detection logic but does not perform file system writes, network requests, or code execution. 4. Sanitization: Not applicable as it is a static rule set. The risk is considered negligible due to the lack of dangerous capabilities.
- [EXTERNAL_DOWNLOADS]: The skill references documentation and foundational guides from the official Vercel AI SDK website (sdk.vercel.ai). These references are legitimate and do not involve untrusted remote code execution.
Audit Metadata