Security risk report for @forgecat/vercel-labs_agent-skills_react-view-transitions v0.0.14
Source Integrity
Low
Profile is sourced from Vercel Labs' official agent-skills repository (pinned commit 063bee94c3f4df8453406c830b0a7df0f2860278).
ForgeCat has transparently documented the upstream origin, preserved the MIT license declaration, and clearly labeled ForgeCat-added reference material separately.
Agent Intent
Low
Content is a legitimate technical guide for React View Transitions API—no instructions to manipulate the AI, read credentials, exfiltrate data, or hide instructions.
No guidance poisoning: recommendations are for well-known, legitimate React/Next.js APIs and standard CSS animation patterns, not typosquatted packages or security-weakening defaults.
No system prompt leakage or role hijacking attempts; the skill is purely educational documentation on animation implementation.
Details
Evidence
Profile describes standard React API usage: `<ViewTransition>`, `addTransitionType`, CSS pseudo-elements.
Implementation guidance follows official React and Next.js documentation patterns.
CSS recipes and code examples are standard web animation techniques with no malicious payloads or obfuscation.
Permissions
Low
No tools or MCP servers are declared; the skill is pure documentation and guidance.
No file system, shell, network, or subagent access is requested or implied.
Authority is limited to reading and understanding the skill's markdown content—appropriate for an educational agent skill.
Details
Evidence
No `tools` or `mcp_servers` sections in the profile.
Skill description is informational only: 'Guide for implementing smooth, native-feeling animations using React's View Transition API.'
No hooks, rules, or alwaysApply directives that would grant excessive agency.
MCP Risk
Low
No MCP servers are defined in the profile.
No binary execution, network access, or filesystem operations are configured.
The skill is purely documentation—no external service dependencies or hidden tool definitions.
Details
Evidence
Profile contains no `mcp_servers` field.
No tool definitions with network, file, or shell capabilities.
ForgeCat