Security risk report for @forgecat/vercel-labs_agent-skills_react-best-practices v0.0.9
Source Integrity
Low
Profile is sourced from a pinned upstream commit (063bee94c3f4df8453406c830b0a7df0f2860278) in the public Vercel Labs agent-skills repository.
ForgeCat-added materials (README, license references) are clearly labeled and do not introduce untrusted external dependencies.
Agent Intent
Low
Content is a legitimate React/Next.js performance optimization guide with no instructions to manipulate the AI, read credentials, exfiltrate data, or hide instructions.
All guidance is standard, well-documented best practices (Promise.all, dynamic imports, Suspense boundaries, memoization) from Vercel Engineering—no poisoned knowledge or security-weakening directives.
No system prompt leakage, role hijacking, or instructions to install remote payloads.
Details
Evidence
AGENTS.md and rule files contain only technical performance patterns with code examples (e.g., 'Promise.all() for Independent Operations', 'Avoid Barrel File Imports').
No language attempting to override agent instructions or manipulate behavior.
Rules are descriptive best practices, not malicious guidance.
Permissions
Low
Profile declares no tools, MCP servers, or file/shell/network permissions.
Skill is purely instructional—it provides guidance for the agent to apply when reviewing or writing React code, with no authority to execute, modify files, or access external systems.
Trigger conditions (React components, Next.js pages, bundle optimization) are narrowly scoped to the stated purpose.
Details
Evidence
'Dependencies: None required to install this profile.'
No tool definitions or MCP server configurations present.
SKILL.md describes only when to apply the guidance, not what permissions are granted.
MCP Risk
Low
No MCP servers are defined in the profile.
No binary execution, network access, or filesystem operations are configured.
Profile is a static knowledge base with no runtime hooks or external integrations.
Details
Evidence
'MCP servers (untrusted data): (none)'
All content is markdown documentation and rule files with no executable components.
ForgeCat