react-best-practices
Pass
Audited by Gen Agent Trust Hub on Sep 28, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADSMETADATA_POISONING
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill instructions guide an AI agent to perform code refactoring and generation based on performance best practices. This capability involves the agent processing user-provided source code, which is potentially untrusted data, to generate modified application code.
- Ingestion points: The agent ingests guidelines from
SKILL.md,AGENTS.md, and individual markdown files in therules/directory. - Boundary markers: The instruction set does not include explicit delimiters or warnings to ignore embedded instructions within the user code being processed.
- Capability inventory: The skill specifies the intended use case as "automated refactoring and code generation" for React components and Next.js pages.
- Sanitization: The skill provides static documentation and does not implement runtime data sanitization.
- [EXTERNAL_DOWNLOADS]: The skill documentation references several external dependencies and tools commonly used in the React development ecosystem.
README.mdspecifies the use ofpnpm installfor project setup.- Rules reference utility libraries such as
better-all(github.com/shuding/better-all) andlru-cache(github.com/isaacs/node-lru-cache) for performance optimization. - Links to official resources for React, Next.js, and SWR are included for technical reference.
- [METADATA_POISONING]: Metadata fields and internal documentation attribute the content to "Vercel Engineering" and state it is "maintained by Vercel," while the skill itself is authored by an independent user. The content aligns with publicly shared engineering practices from Vercel.
Audit Metadata