vercel-react-best-practices
Warn
Audited by Gen Agent Trust Hub on Sep 15, 2026
Risk Level: MEDIUMMETADATA_POISONINGEXTERNAL_DOWNLOADSDYNAMIC_EXECUTIONCOMMAND_EXECUTION
Full Analysis
- [METADATA_POISONING]: The skill's metadata and internal headers claim that 'vercel' is the author and that the guidelines are maintained by 'Vercel Engineering'. This is a deceptive impersonation of a trusted entity, as the skill is provided by an unrelated independent author.
- [EXTERNAL_DOWNLOADS]: The skill requires the installation of several Node.js dependencies from the NPM registry and references external code repositories on GitHub, specifically performance utility libraries like 'better-all'.
- [DYNAMIC_EXECUTION]: The instructions mandate the use of build and validation scripts located in a local 'src/' directory. As these scripts are not included in the provided files, their behavior cannot be verified, presenting a risk of unverified code execution at runtime.
- [COMMAND_EXECUTION]: The README provides specific commands (pnpm build, pnpm validate, pnpm extract-tests) that the agent is expected to run, which interact with local files and the network to build and validate documentation outputs.
Audit Metadata