vercel-react-best-practices
Pass
Audited by Gen Agent Trust Hub on Jul 11, 2026
Risk Level: SAFEPROMPT_INJECTION
Full Analysis
- [PROMPT_INJECTION]: The skill uses deceptive metadata, claiming to be 'maintained by Vercel' and authored by 'Vercel Engineering,' which contradicts the provided author context of 'ujang19.' This impersonation of a trusted vendor may lead users to incorrectly assume the instructions carry official endorsement.
- [PROMPT_INJECTION]: The skill's primary function is to analyze and refactor user-provided source code, which introduces an indirect prompt injection attack surface. Maliciously crafted code could contain instructions designed to influence the agent's behavior during the analysis phase. 1. Ingestion points: User-provided React components, Next.js pages, and API route handlers. 2. Boundary markers: The skill lacks explicit instructions for the agent to use delimiters to separate system guidelines from untrusted external code. 3. Capability inventory: The skill empowers the agent to perform automated refactoring and code generation tasks. 4. Sanitization: No specific steps are provided for the agent to validate or sanitize the input code before processing.
Audit Metadata