sanity-live-cache-components

SUSPICIOUS. The skill is mostly coherent as a Sanity/Next.js integration guide and uses official npm and official Vercel/Sanity sources, but it has two notable security issues: transitive trust in additional remote skills and example code that forwards SANITY_API_READ_TOKEN into both serverToken and browserToken despite stating the token must never reach the client bundle. That inconsistency makes the skill riskier than a normal documentation skill, though not malicious.

The fragment does not show malicious behavior, exfiltration, or obfuscation. It contains a significant credential exposure risk because SANITY_API_READ_TOKEN is supplied as browserToken and live.ts is not explicitly server-only. This can expose a privileged read token to the browser. Keep the token server-side and use a separately scoped browser token or omit browserToken according to the supported Sanity configuration.