vercel-react-best-practices
Warn
Audited by Gen Agent Trust Hub on Oct 26, 2026
Risk Level: MEDIUMMETADATA_POISONINGINDIRECT_PROMPT_INJECTION
Full Analysis
- [METADATA_POISONING]: The skill metadata and internal documentation (SKILL.md and AGENTS.md) claim authorship by 'Vercel Engineering'. However, the publisher is identified as 'suchahaercan95271'. This impersonation is deceptive and intended to leverage the reputation of a trusted organization.
- [METADATA_POISONING]: The guide in AGENTS.md includes a future date of 'January 2026', which is a misrepresentation of the document's timeline intended to suggest authoritative currency.
- [INDIRECT_PROMPT_INJECTION]: The skill provides instructions for the agent to refactor and optimize external codebases without defining security boundaries for untrusted data.
- Ingestion points: React and Next.js codebases provided for refactoring (SKILL.md).
- Boundary markers: Absent; no instructions to delimit or ignore embedded instructions within target code.
- Capability inventory: File system read/write operations across the project structure.
- Sanitization: Absent; the skill does not instruct the agent to escape or validate external content before processing.
Audit Metadata