vercel-composition-patterns
Warn
Audited by Gen Agent Trust Hub on Sep 15, 2026
Risk Level: MEDIUMMETADATA_POISONINGINDIRECT_PROMPT_INJECTION
Full Analysis
- [METADATA_POISONING]: The
SKILL.mdmetadata identifies the author asvercel, which contradicts the actual authorthecoldbloodedidentified in the skill context. This impersonation of a trusted organization can lead to misplaced trust in the skill's safety and authenticity. - [INDIRECT_PROMPT_INJECTION]: The skill operates on user-provided React codebases (Ingestion points: code files analyzed in SKILL.md and AGENTS.md). It lacks explicit boundary markers (Boundary markers: absent) or sanitization (Sanitization: absent) to prevent instructions hidden in code comments from being followed. The risk is low as no executable scripts or dangerous system/network permissions are defined in the skill (Capability inventory: none).
Audit Metadata