Security risk report for @forgecat/vercel-labs_agent-skills_react-native-skills v0.0.9
Source Integrity
Low
Profile is sourced from Vercel Labs' public agent-skills repository (pinned commit 063bee94c3f4df8453406c830b0a7df0f2860278) with transparent upstream attribution.
ForgeCat-added reference materials (LICENSE-SOURCE.md, MIT-STANDARD-REFERENCE.md) are clearly labeled as ForgeCat additions, not upstream content.
Agent Intent
Low
Content is educational guidance for React Native best practices (performance, animations, list optimization, UI patterns)—no instructions to manipulate the AI, read credentials, exfiltrate data, or hide instructions.
Code examples demonstrate correct vs. incorrect patterns; no malicious payloads, typosquatted dependencies, or guidance to weaken security defaults.
No system prompt leakage, role hijacking, or instructions to fetch external URLs or install remote payloads.
Details
Evidence
AGENTS.md and skill rules contain only technical best practices (e.g., 'Animate Transform and Opacity Instead of Layout Properties', 'Use Compressed Images in Lists').
Code examples show legitimate React Native patterns (Reanimated, Gesture Handler, expo-image) from well-known, legitimate libraries.
No instructions to disable TLS, log credentials, or install attacker-controlled dependencies.
Permissions
Low
Profile declares no tools, MCP servers, or executable hooks—it is pure markdown documentation and code examples.
No file_write, file_delete, shell, web_fetch, or subagent permissions requested or implied.
Skill is read-only reference material for an AI agent to consult when building React Native applications.
Details
Evidence
SKILL.md declares 'Dependencies: None required to install this profile.'
No tool definitions, MCP server configurations, or alwaysApply rules present.
Content is static guidance; no dynamic execution or elevated authority.
MCP Risk
Low
No MCP servers defined in the profile.
No hidden instructions in tool descriptions, arbitrary binary execution, or unrestricted network/filesystem access.
Profile is documentation-only; no runtime execution risk.
Details
Evidence
Profile metadata and all skill files contain no MCP server definitions.
No tool descriptions with embedded malicious instructions.
No references to external binaries or network services beyond standard documentation links.
ForgeCat