vercel-react-best-practices
Pass
Audited by Gen Agent Trust Hub on Sep 23, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill serves as a static documentation and guidance repository for React and Next.js performance optimization. It does not contain any executable scripts or hidden commands.
- [EXTERNAL_DOWNLOADS]: Recommends standard and reputable packages such as
swr,lru-cache,lucide-react, andbetter-all(maintained by Vercel staff) for performance gains. All referenced domains (e.g., vercel.com, nextjs.org, react.dev) are well-known and trusted services. - [COMMAND_EXECUTION]: Suggests the use of
npx svgoas a tool for SVG coordinate precision optimization, which is a standard industry practice for reducing asset sizes. - [CREDENTIALS_UNSAFE]: Includes explicit security guidance in the
server-auth-actions.mdrule, teaching developers to perform authentication and authorization checks inside Server Actions to prevent unauthorized access. - [INDIRECT_PROMPT_INJECTION]: While the skill establishes a surface for processing untrusted user code, it mitigates risk by providing clear security boundaries and recommending validation patterns (e.g., using
zodfor input validation) in the resulting code.
Audit Metadata