vercel-composition-patterns

SUSPICIOUS. The skill’s stated purpose is benign React architecture guidance, and most content is normal documentation. However, the recommended scanner introduces a third-party executable package from PyModel despite the skill being branded as Vercel, creating a publisher/provenance mismatch and unnecessary supply-chain exposure. No credential harvesting or malicious exfiltration is evident, so this is not confirmed malware, but the install/execute trust is only moderately coherent with the stated purpose.