Is vercel-react-best-practices safe?
Grade A, 100/100. No meaningful risk found.
React and Next.js performance optimization guidelines from Vercel Engineering. This skill should be used when writing, reviewing, or refactoring React/Next.js code to ensure optimal performance patterns. Triggers on tasks involving React components, Next.js pages, data fetching, bundle optimization, or performance improvements.
Avercel-react-best-practices
skills/react-best-practices100/100 · No meaningful risk foundNo security findings
vercel-react-best-practices
skills/react-best-practicesReact and Next.js performance optimization guidelines from Vercel Engineering. This skill should be used when writing, reviewing, or refactoring React/Next.js code to ensure optimal performance patterns. Triggers on tasks involving React components, Next.js pages, data fetching, bundle optimization, or performance improvements.
- Content hash
- sha256:741c320ab924f3d033c763574c1a166e4318454937dce6e10015f0230830a6bf
- Files
- 76
- Quality
- 100/100
Security findings
- infoUnpinned package installSL501 · skills/react-best-practices/AGENTS.md:2477
npx svgo --precision=1 --multipass icon.svgInstalling without a version means a future malicious release lands automatically. Fix: Pin an exact version (pkg==1.2.3, pkg@1.2.3). Severity lowered: the line reads as documentation, not an instruction.
- infoUnpinned package installSL501 · skills/react-best-practices/rules/rendering-svg-precision.md:27
npx svgo --precision=1 --multipass icon.svgInstalling without a version means a future malicious release lands automatically. Fix: Pin an exact version (pkg==1.2.3, pkg@1.2.3). Severity lowered: the line reads as documentation, not an instruction.
Files in this skill
- AGENTS.md105.7 KB
- README.md3.3 KB
- SKILL.md7.1 KB
- metadata.json921 B
- rules/_sections.md1.5 KB
- rules/_template.md631 B
- rules/advanced-effect-event-deps.md1.8 KB
- rules/advanced-event-handler-refs.md1.4 KB
- rules/advanced-init-once.md958 B
- rules/advanced-use-latest.md1.0 KB
- rules/async-api-routes.md1.1 KB
- rules/async-cheap-condition-before-await.md1.2 KB
- rules/async-defer-await.md2.2 KB
- rules/async-dependencies.md1.3 KB
- rules/async-parallel.md654 B
- rules/async-suspense-boundaries.md2.5 KB
- rules/bundle-analyzable-paths.md2.3 KB
- rules/bundle-barrel-imports.md2.7 KB
- rules/bundle-conditional.md949 B
- rules/bundle-defer-third-party.md920 B
- rules/bundle-dynamic-imports.md791 B
- rules/bundle-preload.md1.1 KB
- rules/client-event-listeners.md1.9 KB
- rules/client-localstorage-schema.md1.9 KB
- rules/client-passive-event-listeners.md1.6 KB
- rules/client-swr-dedup.md1.1 KB
- rules/js-batch-dom-css.md3.2 KB
- rules/js-cache-function-results.md1.9 KB
- rules/js-cache-property-access.md532 B
- rules/js-cache-storage.md1.6 KB
- rules/js-combine-iterations.md753 B
- rules/js-early-exit.md1.1 KB
- rules/js-flatmap-filter.md1.4 KB
- rules/js-hoist-regexp.md1.0 KB
- rules/js-index-maps.md837 B
- rules/js-length-check-first.md1.7 KB
- rules/js-min-max-loop.md2.2 KB
- rules/js-request-idle-callback.md2.6 KB
- rules/js-set-map-lookups.md532 B
- rules/js-tosorted-immutable.md1.7 KB
- rules/rendering-activity.md564 B
- rules/rendering-animate-svg-wrapper.md1.2 KB
- rules/rendering-conditional-render.md980 B
- rules/rendering-content-visibility.md815 B
- rules/rendering-hoist-jsx.md1.0 KB
- rules/rendering-hydration-no-flicker.md2.3 KB
- rules/rendering-hydration-suppress-warning.md872 B
- rules/rendering-resource-hints.md2.5 KB
- rules/rendering-script-defer-async.md1.8 KB
- rules/rendering-svg-precision.md588 B
- rules/rendering-usetransition-loading.md2.0 KB
- rules/rerender-defer-reads.md973 B
- rules/rerender-dependencies.md824 B
- rules/rerender-derived-state-no-effect.md1.2 KB
- rules/rerender-derived-state.md728 B
- rules/rerender-functional-setstate.md2.9 KB
- rules/rerender-lazy-state-init.md2.0 KB
- rules/rerender-memo-with-default-value.md1.1 KB
- rules/rerender-memo.md1.1 KB
- rules/rerender-move-effect-to-event.md1.2 KB
- rules/rerender-no-inline-components.md2.1 KB
- rules/rerender-simple-expression-in-memo.md1018 B
- rules/rerender-split-combined-hooks.md1.8 KB
- rules/rerender-transitions.md1.0 KB
- rules/rerender-use-deferred-value.md1.8 KB
- rules/rerender-use-ref-transient-values.md1.7 KB
- rules/server-after-nonblocking.md2.0 KB
- rules/server-auth-actions.md2.6 KB
- rules/server-cache-lru.md1.3 KB
- rules/server-cache-react.md2.2 KB
- rules/server-dedup-props.md2.0 KB
- rules/server-hoist-static-io.md4.3 KB
- rules/server-no-shared-module-state.md1.7 KB
- rules/server-parallel-fetching.md1.5 KB
- rules/server-parallel-nested-fetching.md992 B
- rules/server-serialization.md996 B
Questions about vercel-react-best-practices
- Is vercel-react-best-practices safe to install?
- Our scanner gave vercel-react-best-practices grade A (100/100): no meaningful risk found. None of the 30 security rules matched. Static analysis cannot prove safety, so pin the reviewed revision with a lockfile.
- How do I install vercel-react-best-practices in Claude Code or Codex?
- Run skillhash add github:vercel-labs/agent-skills/skills/react-best-practices. It downloads the exact commit, checks the grade against your policy, writes skills.lock and installs it into .claude/skills and .agents/skills.
- What happens if vercel-react-best-practices changes upstream?
- Its content hash changes. skillhash verify fails in CI until you review the new version and update the lock. With a watch, you also get an alert.
More from vercel-labs/agent-skills
- A
vercel-composition-patterns
33kvercel-labs/agent-skills
React composition patterns that scale. Use when refactoring components with boolean prop proliferation, building flexible component libraries, or designing reusable APIs. Triggers on tasks involving compound components, render props, context providers, or component architecture. Includes React 19 API changes.
No security findings - A
web-design-guidelines
33kvercel-labs/agent-skills
Review UI code for Web Interface Guidelines compliance. Use when asked to "review my UI", "check accessibility", "audit design", "review UX", or "check my site against best practices".
No security findings - A
writing-guidelines
33kvercel-labs/agent-skills
Review docs/prose for Writing Guidelines compliance. Use when asked to "review my docs", "check writing style", "audit prose", "review docs voice and tone", or "check this page against the writing handbook".
No security findings - A
vercel-react-native-skills
33kvercel-labs/agent-skills
React Native and Expo best practices for building performant mobile apps. Use when building React Native components, optimizing list performance, implementing animations, or working with native modules. Triggers on tasks involving React Native, Expo, mobile performance, or native platform APIs.
No security findings - A
vercel-react-view-transitions
33kvercel-labs/agent-skills
Guide for implementing smooth, native-feeling animations using React's View Transition API (`<ViewTransition>` component, `addTransitionType`, and CSS view transition pseudo-elements). Use this skill whenever the user wants to add page transitions, animate route changes, create shared element animations, animate enter/exit of components, animate list reorder, implement directional (forward/back) navigation animations, or integrate view transitions in Next.js. Also use when the user mentions view transitions, `startViewTransition`, `ViewTransition`, transition types, or asks about animating between UI states in React without third-party animation libraries.
No security findings - A
vercel-optimize
33kvercel-labs/agent-skills
Use for Vercel cost and performance optimization on deployed projects, especially Next.js, SvelteKit, Nuxt, and limited Astro apps. Collect Vercel metrics, usage, project config, and code scan results first; investigate only metric-backed candidates; produce ranked recommendations grounded in verified files and version-aware Vercel/framework docs. Trigger for Vercel bill reduction, slow or expensive routes, caching opportunities, Function Invocations, Build Minutes, Fast Data Transfer, Core Web Vitals, Bot Management, Fluid compute, or cost breakdown requests.
No security findings - B
vercel-cli-with-tokens
33kvercel-labs/agent-skills
Deploy and manage projects on Vercel using token-based authentication. Use when working with Vercel CLI using access tokens rather than interactive login — e.g. "deploy to vercel", "set up vercel", "add environment variables to vercel".
4 medium2 low - B
deploy-to-vercel
33kvercel-labs/agent-skills
Deploy applications and websites to Vercel. Use when the user requests deployment actions like "deploy my app", "deploy and give me the link", "push this live", or "create a preview deployment".
3 medium1 low