vercel-development
Pass
Audited by Gen Agent Trust Hub on Sep 15, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [SAFE]: The skill provides legitimate architectural and development guidelines for Next.js and Vercel. It encourages security best practices such as using environment variables for sensitive data (API keys) and implementing schema validation with Zod for API endpoints.
- [INDIRECT_PROMPT_INJECTION]: The skill provides code templates for building AI-powered chat interfaces which create a standard surface area for indirect prompt injection when processing user-supplied data.
- Ingestion points:
app/api/chat/route.tsingestsmessagesdirectly from the request body. - Boundary markers: The code snippet includes a hardcoded
systemprompt boundary. - Capability inventory:
app/api/chat/route.tsutilizes the Vercel AI SDK to interface with external LLM models. - Sanitization: No explicit input sanitization or filtering is included in the provided chat API example.
Audit Metadata