ClawHub
Back to skill

Security audit

Vercel React Best Practices

Security checks for vulnerabilities and agentic risk

Overview

This is a documentation-only React/Next.js skill, but it teaches several risky patterns that could make generated apps less secure if followed directly.

Review this skill before letting an agent apply it automatically. Pin or use a local SVGO dependency instead of unpinned npx, avoid copying dangerouslySetInnerHTML unless the script is static and CSP-reviewed, never log raw session cookies, and only use cross-request caches with keys and data scoped to the same authorization context.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T08 · Insecure Dependencies

Warning
Location
rules/rendering-svg-precision.md:27
Finding

Unpinned Third-Party CLI Execution Through npx

Content
View full analysis

Vulnerability Details

File Location: rules/rendering-svg-precision.md:27
Vulnerability Type: Insecure third-party dependency execution
Risk Level: Medium

Vulnerable Code

bash
npx svgo --precision=1 --multipass icon.svg

The same command also appears in the generated document at AGENTS.md:2078.

Technical Analysis

The guidance instructs an agent or user to execute svgo through npx without specifying a package version or requiring resolution from a reviewed, lockfile-controlled dependency. If the package is unavailable locally, npx may retrieve and execute it from the configured package registry.

Because the resolved package version and registry content can change after this Skill is reviewed, the command introduces a supply-chain execution boundary. A compromised package release, malicious registry configuration, or dependency-resolution attack could cause attacker-controlled package or lifecycle code to run locally.

Executing an external package is not required merely to explain the recommendation to reduce SVG coordinate precision. The instruction therefore grants a third-party dependency more capability than the Skill's documentation purpose requires.

Attack Path

  1. A user or AI agent follows the optimization instruction.
  2. The agent runs npx svgo --precision=1 --multipass icon.svg.
  3. If no trusted local version is installed, npx resolves the unpinned package through the configured registry.
  4. The registry supplies a compromised or unexpectedly changed package version.
  5. Package installation, lifecycle, or CLI code executes with the invoking user's permissions.
  6. The malicious code may read or modify accessible project files, environment data, credentials, and other user-accessible resources.

This is a conditional supply-chain path; the audited artifact does not itself contain a confirmed malicious svgo payload.

Impact Assessment

Successful exploitation would provide code execution under the ...[truncated 492 chars]

Remediation
View remediation

Remediation Suggestions

  1. Add a reviewed svgo version to the project's development dependencies and commit the package-manager lockfile.
  2. Invoke only the lockfile-resolved local binary, for example:
bash
pnpm exec svgo --precision=1 --multipass icon.svg
  1. Avoid commands that implicitly download and execute packages during Skill use.
  2. In automated environments, use a trusted registry, immutable dependency versions, integrity verification, and disabled or tightly controlled package lifecycle scripts.
  3. Clarify that the command is optional and that SVG coordinates can instead be reviewed or adjusted manually.
  4. Apply the same correction to the generated copy in AGENTS.md, preferably by regenerating it from the corrected rule source.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Output HandlingUnvalidated Output Injection, Cross-Context Output, Unbounded Output
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (12)

Unvalidated Output Injection

High
Category
Output Handling
Confidence
95% confidence
Finding

dangerouslySetInnerHTML is a high-risk sink because any future interpolation of user-controlled or variable data into the script body can become immediate script execution in the browser. Even though the example currently uses a static string, placing this construct in an AI-targeted best-practices document increases the chance that generated code will reuse the sink in less safe contexts, making the skill context more dangerous rather than less.

Content

Scanner excerpt · AGENTS.md (reported line 2138)May include surrounding context.

md
{children}
      </div>
      <script
        dangerouslySetInnerHTML={{
          __html: `
            (function() {
              try {

Unvalidated Output Injection

High
Category
Output Handling
Confidence
95% confidence
Finding

dangerouslySetInnerHTML is a well-known unsafe output sink, and here it is used to inject executable script content. In this exact snippet the payload is constant, but the skill teaches a pattern that bypasses React's escaping guarantees and can become a direct XSS vector if any variable content is later embedded into the script or copied into broader contexts.

Content

Scanner excerpt · rules/rendering-hydration-no-flicker.md (reported line 63)May include surrounding context.

md
{children}
      </div>
      <script
        dangerouslySetInnerHTML={{
          __html: `
            (function() {
              try {

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

This guidance normalizes injecting raw inline scripts via dangerouslySetInnerHTML, which expands the set of code-generation patterns an agent may emit into downstream apps. In a best-practices skill focused on React/Next.js performance, promoting raw script injection is risky because it can bypass safer framework abstractions, complicate CSP adoption, and make XSS-prone patterns seem acceptable.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The guidance explicitly recommends using an inline script via dangerouslySetInnerHTML to mutate the DOM before hydration. While the sample script is static and not directly attacker-controlled, this pattern normalizes a high-risk capability that can easily become an XSS sink if future users interpolate untrusted data into the script or relax CSP to permit unsafe inline scripts.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
70% confidence
Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
70% confidence
Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

This guidance incorrectly states that useTransition should replace manual loading state for async fetching and claims behaviors such as automatic pending management for the fetch lifecycle and cancellation of prior requests that useTransition does not guarantee. Developers following this pattern may ship misleading loading indicators, stale-result race conditions, and incorrect assumptions about interrupt/cancel behavior, which can degrade correctness and reliability in user-facing flows.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
88% confidence
Finding

The guidance explicitly shows capturing and logging request-derived identifiers such as the user-agent and a session cookie value, but it provides no warning about minimizing, redacting, hashing, or governing sensitive data in logs. In a best-practices skill, this can normalize unsafe telemetry patterns and lead downstream users to persist identifiers that may be personal data, secrets, or session-linked information.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The guidance recommends a process-wide cross-request LRU cache and demonstrates caching user records by ID without any warning that such caches can mix data across users, sessions, or authorization contexts if reused inappropriately. In a React/Next.js best-practices skill, readers may copy this pattern broadly, including for personalized or permission-scoped data, which can lead to cross-request data exposure or stale authorization decisions.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
84% confidence
Finding

This markdown guidance explicitly advises reading from client-side storage such as localStorage and cookies to alter rendered content, but it does not include any warning about privacy or user-data implications. Under the markdown-specific missing-warning rule, behavior that affects user data or privacy should be disclosed to the user.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
87% confidence
Finding

This markdown file includes an example that initiates network-related resource hints to third-party and API domains, which can cause the browser to contact external systems before the user explicitly navigates there. The description does not warn that these hints may disclose user/system metadata such as IP address or browsing intent to external services.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
78% confidence
Finding

This markdown file includes example code that calls post('/api/register'), which represents a network operation that may transmit user data. The surrounding skill text explains architectural guidance but does not warn that the example performs an HTTP request or that such actions may affect user data/privacy.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.