vercel-react-best-practices
Pass
Audited by Gen Agent Trust Hub on Oct 6, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill is a documentation-only resource consisting of Markdown files that provide architectural and performance guidelines for React and Next.js. It does not contain any executable scripts or hidden payloads.
- [METADATA_POISONING]: The skill manifest (SKILL.md) identifies the author as 'vercel', whereas the repository context lists 'huangzida'. However, the documentation clearly states that the content was originally created by Vercel Engineering and provides appropriate attribution and links to official sources, mitigating any concerns of deceptive impersonation.
- [EXTERNAL_DOWNLOADS]: The skill references several well-known and reputable Node.js packages (e.g.,
swr,zod,lru-cache,next) and official GitHub repositories (e.g.,shuding/better-all) as part of its recommended development patterns. These references are standard for the described React/Next.js ecosystem and do not point to untrusted or suspicious sources. - [INDIRECT_PROMPT_INJECTION]: While the skill contains instructions intended for AI agents (found in AGENTS.md), these instructions are focused on providing high-quality code generation and refactoring patterns. There are no attempts to override agent safety filters, bypass instructions, or exfiltrate data.
Audit Metadata