vercel-react-native-skills
Pass
Audited by Gen Agent Trust Hub on Sep 26, 2026
Risk Level: SAFEMETADATA_POISONINGINDIRECT_PROMPT_INJECTION
Full Analysis
- [METADATA_POISONING]: The skill metadata identifies the author as 'vercel' and the name as 'vercel-react-native-skills', which contradicts the actual provider 'liuchiawei'. This is a deceptive practice intended to leverage the reputation of a trusted vendor, although the content appears to be a legitimate collection of development guidelines.
- [INDIRECT_PROMPT_INJECTION]: The skill defines a large set of instructions for an AI agent to apply when analyzing or writing React Native code. This creates a surface where maliciously crafted code provided by a user could leverage these rules to influence the agent's behavior.
- Ingestion points: Processes React Native and Expo code samples provided in the agent's context during development tasks.
- Boundary markers: None present. The instructions do not define delimiters to separate the rules from the untrusted data being processed.
- Capability inventory: The skill contains no executable scripts, tools, or network operations; it is purely documentation-based.
- Sanitization: No sanitization or validation logic is defined for the code samples processed by the agent.
Audit Metadata