react-best-practices

Pass

Audited by Gen Agent Trust Hub on Sep 28, 2026

Risk Level: SAFEINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADSMETADATA_POISONING
Full Analysis
  • [INDIRECT_PROMPT_INJECTION]: The skill instructions guide an AI agent to perform code refactoring and generation based on performance best practices. This capability involves the agent processing user-provided source code, which is potentially untrusted data, to generate modified application code.
  • Ingestion points: The agent ingests guidelines from SKILL.md, AGENTS.md, and individual markdown files in the rules/ directory.
  • Boundary markers: The instruction set does not include explicit delimiters or warnings to ignore embedded instructions within the user code being processed.
  • Capability inventory: The skill specifies the intended use case as "automated refactoring and code generation" for React components and Next.js pages.
  • Sanitization: The skill provides static documentation and does not implement runtime data sanitization.
  • [EXTERNAL_DOWNLOADS]: The skill documentation references several external dependencies and tools commonly used in the React development ecosystem.
  • README.md specifies the use of pnpm install for project setup.
  • Rules reference utility libraries such as better-all (github.com/shuding/better-all) and lru-cache (github.com/isaacs/node-lru-cache) for performance optimization.
  • Links to official resources for React, Next.js, and SWR are included for technical reference.
  • [METADATA_POISONING]: Metadata fields and internal documentation attribute the content to "Vercel Engineering" and state it is "maintained by Vercel," while the skill itself is authored by an independent user. The content aligns with publicly shared engineering practices from Vercel.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 28, 2026, 09:40 AM