Security risk report for @forgecat/vercel-labs_agent-skills_react-native-skills v0.0.8
Source Integrity
Low
Profile sourced from Vercel Labs (vercel-labs/agent-skills), a known legitimate organization.
Content is a curated collection of React Native best practices with clear attribution and MIT license.
No suspicious external dependencies or supply-chain indicators detected.
Agent Intent
Low
Content is purely educational and prescriptive—it documents React Native performance patterns and best practices.
No instructions to manipulate the AI, read credentials, exfiltrate data, or hide instructions.
No guidance poisoning: recommendations are for well-known, legitimate libraries (react-native-reanimated, expo-router, LegendList, FlashList) and standard React patterns.
Examples show correct vs. incorrect code patterns; no malicious templates or security-weakening directives embedded.
Details
Evidence
All rules follow a consistent structure: title, impact level, explanation, incorrect example, correct example, reference.
Examples teach performance optimization (e.g., 'Animate Transform and Opacity Instead of Layout Properties'), not malicious behavior.
No instructions to disable security features, install untrusted packages, or bypass platform safeguards.
Permissions
Low
Profile declares no tools, hooks, or MCP servers—it is pure markdown documentation.
No file system access, shell execution, or network requests requested or implied.
Authority is limited to providing guidance text that an AI agent will read and apply to code generation tasks.
Details
Evidence
'Declared tools' section is empty.
'MCP servers' section is empty.
Profile is a skill/knowledge base, not an executable agent with elevated permissions.
MCP Risk
Low
No MCP servers defined in the profile.
No external binaries, network calls, or filesystem mutations triggered by the profile itself.
Content is static markdown—no dynamic code execution or hidden tool definitions.
Details
Evidence
'MCP servers (untrusted data)' section explicitly states '(none)'.
Profile structure is metadata + markdown files only; no executable payloads.
ForgeCat