vercel-react-best-practices
Fail
Audited by Gen Agent Trust Hub on Feb 16, 2026
Risk Level: HIGHPROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
- Indirect Prompt Injection (HIGH): This skill is designed to handle untrusted source code and is intended for 'automated refactoring', which implies file-writing or code-modification capabilities. Evidence: (1) Ingestion points: External React/Next.js code provided as input for review; (2) Boundary markers: No delimiters or instructions to ignore embedded instructions within the input code are specified; (3) Capability inventory: Automated refactoring and code generation; (4) Sanitization: No sanitization or filtering of input code is mentioned. Per the reasoning framework, processing external content with write-level capabilities constitutes a High-tier risk.
- Unverifiable Dependencies & Remote Code Execution (MEDIUM): The 'async-dependencies' rule recommends the use of 'better-all'. This package is not a standard React or Vercel utility and could not be verified as a trusted source. Recommending unknown third-party packages in a guide intended for automated refactoring introduces a supply chain risk.
Recommendations
- AI detected serious security threats
Audit Metadata