vercel-react-best-practices
Pass
Audited by Gen Agent Trust Hub on Jun 16, 2026
Risk Level: SAFE
Full Analysis
- [PROMPT_INJECTION]: No instructions were found that attempt to override the AI agent's core behavioral constraints or bypass safety filters. The instructions are focused entirely on technical guidance for React and Next.js optimization.
- [DATA_EXFILTRATION]: The skill does not contain any logic for accessing local sensitive files (like credentials or SSH keys) or sending user data to external servers. All network references point to well-known documentation and official software repositories.
- [OBFUSCATION]: No evidence of Base64 encoding, zero-width characters, homoglyphs, or other techniques used to hide malicious intent or URLs was found.
- [REMOTE_CODE_EXECUTION]: There are no patterns suggesting the dynamic download or execution of remote scripts. Code snippets provided in the documentation are for educational purposes and not intended for automated execution by the agent environment.
- [COMMAND_EXECUTION]: The skill does not request access to shell tools or execute subprocesses. While the README mentions build scripts (pnpm build), these are intended for repository maintenance by human contributors and are not part of the skill's operational logic for the AI agent.
- [CREDENTIALS_UNSAFE]: No hardcoded API keys, tokens, or other secrets were found within the 76 files analyzed.
- [SAFE]: The skill actually promotes security best practices, such as the 'Authenticate Server Actions Like API Routes' rule, which explicitly instructs developers to implement server-side authorization checks to prevent unauthorized access.
Audit Metadata