{"data":{"skill":{"slug":"vercel-labs-vercel-composition-patterns","name":"vercel-composition-patterns","icon":"📦","repo":"https://github.com/vercel-labs/agent-skills/tree/1a2c79d4e6c4a2283dc2c614b6538cbe1ed5ca62/skills/composition-patterns","status":"approved","author":"vercel-labs","authorVersion":"1.0.0","skillstoreRevision":2,"license":"MIT"},"licenseCorrection":null,"audit":{"id":"2c05f692-9a2e-4626-a0e9-2b8c8674684b","skill_id":"b690b812-7618-45e1-9b91-a843999f9187","version":5,"content_hash":"v3:1f79e59ae427a74eab604c013e03b61f04634721:e38e0eaa609316b10423a9a138ed95e35099accd3f735585295c8a8f165c28a3:144b5f15908f5bc887888c7f62fcf778a8d79a9dc22fdd45669e21216c9ade68:736b696c6c732f76657263656c2d6c6162732f76657263656c2d636f6d706f736974696f6e2d7061747465726e73:dd020df6a4cb2d054824d67e54e98bd5","risk_level":"safe","is_blocked":false,"safe_to_publish":true,"analysis_status":"ok","agent_auto_install_policy":"allowed","manual_install_policy":"allowed","summary":"All 31 static findings are false positives involving React guidance, TypeScript signatures, Markdown formatting, or documentation reference URLs. No evidence found of command execution, system reconnaissance, data exfiltration, or prompt injection in the reviewed source context.","remediation":[],"risk_factor_evidence":[{"factor":"network","evidence":[{"file":"metadata.json","line_end":7,"line_start":7},{"file":"metadata.json","line_end":8,"line_start":8},{"file":"metadata.json","line_end":9,"line_start":9}]},{"factor":"external_commands","evidence":[{"file":"SKILL.md","line_end":36,"line_start":36},{"file":"SKILL.md","line_end":37,"line_start":37},{"file":"SKILL.md","line_end":38,"line_start":38},{"file":"SKILL.md","line_end":39,"line_start":39},{"file":"SKILL.md","line_end":45,"line_start":45},{"file":"SKILL.md","line_end":47,"line_start":47},{"file":"SKILL.md","line_end":52,"line_start":52},{"file":"SKILL.md","line_end":54,"line_start":54},{"file":"SKILL.md","line_end":56,"line_start":56},{"file":"SKILL.md","line_end":60,"line_start":60},{"file":"SKILL.md","line_end":62,"line_start":62},{"file":"SKILL.md","line_end":69,"line_start":69},{"file":"SKILL.md","line_end":78,"line_start":75},{"file":"SKILL.md","line_end":89,"line_start":78}]}],"critical_findings":[],"high_findings":[],"medium_findings":[],"low_findings":[],"dangerous_patterns":[],"files_scanned":14,"total_lines":2043,"audit_model":"codex","audited_at":"2026-11-09T12:03:59.447+00:00","created_at":"2026-11-10T01:32:08.110247+00:00","static_findings":[{"id":"blocker:AGENTS.md:17:system-reconnaissance","file":"AGENTS.md","pattern":"System reconnaissance","snippet":"Composition patterns for building flexible, maintainable React components. Avoid boolean prop prolif","category":"blocker","line_end":17,"severity":"low","line_start":17},{"id":"blocker:AGENTS.md:24:system-reconnaissance","file":"AGENTS.md","pattern":"System reconnaissance","snippet":"- 1.1 [Avoid Boolean Prop Proliferation](#11-avoid-boolean-prop-proliferation)","category":"blocker","line_end":24,"severity":"low","line_start":24},{"id":"blocker:AGENTS.md:42:system-reconnaissance","file":"AGENTS.md","pattern":"System reconnaissance","snippet":"Fundamental patterns for structuring components to avoid prop","category":"blocker","line_end":42,"severity":"low","line_start":42},{"id":"blocker:AGENTS.md:45:system-reconnaissance","file":"AGENTS.md","pattern":"System reconnaissance","snippet":"### 1.1 Avoid Boolean Prop Proliferation","category":"blocker","line_end":45,"severity":"low","line_start":45},{"id":"blocker:AGENTS.md:412:system-reconnaissance","file":"AGENTS.md","pattern":"System reconnaissance","snippet":"update: (updater: (state: ComposerState) => ComposerState) => void","category":"blocker","line_end":413,"severity":"low","line_start":412},{"id":"blocker:AGENTS.md:413:system-reconnaissance","file":"AGENTS.md","pattern":"System reconnaissance","snippet":"submit: () => void","category":"blocker","line_end":414,"severity":"low","line_start":413},{"id":"network:metadata.json:7:hardcoded-url","file":"metadata.json","pattern":"Hardcoded URL","snippet":"\"https://react.dev\",","category":"network","line_end":7,"severity":"low","line_start":7},{"id":"network:metadata.json:8:hardcoded-url","file":"metadata.json","pattern":"Hardcoded URL","snippet":"\"https://react.dev/learn/passing-data-deeply-with-context\",","category":"network","line_end":8,"severity":"low","line_start":8},{"id":"network:metadata.json:9:hardcoded-url","file":"metadata.json","pattern":"Hardcoded URL","snippet":"\"https://react.dev/reference/react/use\"","category":"network","line_end":9,"severity":"low","line_start":9},{"id":"blocker:metadata.json:5:system-reconnaissance","file":"metadata.json","pattern":"System reconnaissance","snippet":"\"abstract\": \"Composition patterns for building flexible, maintainable React components. Avoid boolea","category":"blocker","line_end":5,"severity":"low","line_start":5},{"id":"blocker:README.md:4:system-reconnaissance","file":"README.md","pattern":"System reconnaissance","snippet":"patterns help avoid boolean prop proliferation by using compound components,","category":"blocker","line_end":4,"severity":"low","line_start":4},{"id":"blocker:rules/_sections.md:11:system-reconnaissance","file":"rules/_sections.md","pattern":"System reconnaissance","snippet":"**Description:** Fundamental patterns for structuring components to avoid prop","category":"blocker","line_end":11,"severity":"low","line_start":11},{"id":"blocker:rules/architecture-avoid-boolean-props.md:2:system-reconnaissance","file":"rules/architecture-avoid-boolean-props.md","pattern":"System reconnaissance","snippet":"title: Avoid Boolean Prop Proliferation","category":"blocker","line_end":2,"severity":"low","line_start":2},{"id":"blocker:rules/architecture-avoid-boolean-props.md:8:system-reconnaissance","file":"rules/architecture-avoid-boolean-props.md","pattern":"System reconnaissance","snippet":"## Avoid Boolean Prop Proliferation","category":"blocker","line_end":8,"severity":"low","line_start":8},{"id":"blocker:rules/state-context-interface.md:39:system-reconnaissance","file":"rules/state-context-interface.md","pattern":"System reconnaissance","snippet":"update: (updater: (state: ComposerState) => ComposerState) => void","category":"blocker","line_end":40,"severity":"low","line_start":39},{"id":"blocker:rules/state-context-interface.md:40:system-reconnaissance","file":"rules/state-context-interface.md","pattern":"System reconnaissance","snippet":"submit: () => void","category":"blocker","line_end":41,"severity":"low","line_start":40},{"id":"external_commands:SKILL.md:36:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"| 1        | Component Architecture  | HIGH   | `architecture-` |","category":"external_commands","line_end":36,"severity":"medium","line_start":36},{"id":"external_commands:SKILL.md:37:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"| 2        | State Management        | MEDIUM | `state-`        |","category":"external_commands","line_end":37,"severity":"medium","line_start":37},{"id":"external_commands:SKILL.md:38:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"| 3        | Implementation Patterns | MEDIUM | `patterns-`     |","category":"external_commands","line_end":38,"severity":"medium","line_start":38},{"id":"external_commands:SKILL.md:39:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"| 4        | React 19 APIs           | MEDIUM | `react19-`      |","category":"external_commands","line_end":39,"severity":"medium","line_start":39},{"id":"external_commands:SKILL.md:45:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- `architecture-avoid-boolean-props` - Don't add boolean props to customize","category":"external_commands","line_end":45,"severity":"medium","line_start":45},{"id":"external_commands:SKILL.md:47:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- `architecture-compound-components` - Structure complex components with shared","category":"external_commands","line_end":47,"severity":"medium","line_start":47},{"id":"external_commands:SKILL.md:52:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- `state-decouple-implementation` - Provider is the only place that knows how","category":"external_commands","line_end":52,"severity":"medium","line_start":52},{"id":"external_commands:SKILL.md:54:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- `state-context-interface` - Define generic interface with state, actions, meta","category":"external_commands","line_end":54,"severity":"medium","line_start":54},{"id":"external_commands:SKILL.md:56:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- `state-lift-state` - Move state into provider components for sibling access","category":"external_commands","line_end":56,"severity":"medium","line_start":56},{"id":"external_commands:SKILL.md:60:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- `patterns-explicit-variants` - Create explicit variant components instead of","category":"external_commands","line_end":60,"severity":"medium","line_start":60},{"id":"external_commands:SKILL.md:62:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- `patterns-children-over-render-props` - Use children for composition instead","category":"external_commands","line_end":62,"severity":"medium","line_start":62},{"id":"external_commands:SKILL.md:69:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- `react19-no-forwardref` - Don't use `forwardRef`; use `use()` instead of `useContext()`","category":"external_commands","line_end":69,"severity":"medium","line_start":69},{"id":"external_commands:SKILL.md:75:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":78,"severity":"medium","line_start":75},{"id":"external_commands:SKILL.md:78:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":89,"severity":"medium","line_start":78},{"id":"blocker:SKILL.md:17:system-reconnaissance","file":"SKILL.md","pattern":"System reconnaissance","snippet":"Composition patterns for building flexible, maintainable React components. Avoid","category":"blocker","line_end":18,"severity":"low","line_start":17}],"finding_verdicts":[{"id":"blocker:AGENTS.md:17:system-reconnaissance","reason":"The abstract discusses React component composition and boolean props. It contains no instructions to inspect the host system.","verdict":"false_positive","confidence":0.99},{"id":"blocker:AGENTS.md:24:system-reconnaissance","reason":"This table of contents entry links to the boolean prop guidance section. It does not request system information.","verdict":"false_positive","confidence":0.99},{"id":"blocker:AGENTS.md:42:system-reconnaissance","reason":"The section introduction describes structuring React components to avoid prop proliferation. There is no host inspection behavior.","verdict":"false_positive","confidence":0.99},{"id":"blocker:AGENTS.md:45:system-reconnaissance","reason":"The matched text is the heading 'Avoid Boolean Prop Proliferation'. It is a component design topic, not a reconnaissance instruction.","verdict":"false_positive","confidence":0.99},{"id":"blocker:AGENTS.md:412:system-reconnaissance","reason":"The update member is a TypeScript callback signature for modifying composer state. Its void return type does not represent a system command.","verdict":"false_positive","confidence":0.99},{"id":"blocker:AGENTS.md:413:system-reconnaissance","reason":"The submit member is a TypeScript action signature returning void. It contains no implementation or host reconnaissance operation.","verdict":"false_positive","confidence":0.99},{"id":"network:metadata.json:7:hardcoded-url","reason":"The React documentation homepage appears in a metadata references array. It is a citation, not a network request or data destination.","verdict":"false_positive","confidence":0.99},{"id":"network:metadata.json:8:hardcoded-url","reason":"This URL cites the official React context tutorial in the references array. No request, payload, or credential transfer is specified.","verdict":"false_positive","confidence":0.99},{"id":"network:metadata.json:9:hardcoded-url","reason":"This URL cites the official React use API documentation. The metadata contains no executable network behavior.","verdict":"false_positive","confidence":0.99},{"id":"blocker:metadata.json:5:system-reconnaissance","reason":"The abstract describes maintainable React components and avoiding boolean props. It does not describe collecting host information.","verdict":"false_positive","confidence":0.99},{"id":"blocker:README.md:4:system-reconnaissance","reason":"The introductory prose discusses avoiding boolean prop proliferation through composition. No reconnaissance command or instruction appears.","verdict":"false_positive","confidence":0.99},{"id":"blocker:rules/_sections.md:11:system-reconnaissance","reason":"This section description concerns component structure and prop proliferation. It provides no instructions for inspecting system resources.","verdict":"false_positive","confidence":0.99},{"id":"blocker:rules/architecture-avoid-boolean-props.md:2:system-reconnaissance","reason":"The YAML title names a React component architecture rule. It is metadata rather than a host inspection operation.","verdict":"false_positive","confidence":0.99},{"id":"blocker:rules/architecture-avoid-boolean-props.md:8:system-reconnaissance","reason":"The Markdown heading repeats the boolean prop architecture rule title. It contains no command or reconnaissance request.","verdict":"false_positive","confidence":0.99},{"id":"blocker:rules/state-context-interface.md:39:system-reconnaissance","reason":"The update callback signature defines how composer state changes. This TypeScript interface does not execute code or enumerate system information.","verdict":"false_positive","confidence":0.99},{"id":"blocker:rules/state-context-interface.md:40:system-reconnaissance","reason":"The submit action is declared as a function returning void. A type declaration alone does not perform reconnaissance.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:36:ruby-shell-backtick-execution","reason":"Backticks format the architecture- rule prefix inside a Markdown table. They are not shell or Ruby execution syntax in this document.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:37:ruby-shell-backtick-execution","reason":"Backticks mark the state- category prefix as inline Markdown code. There is no executable command.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:38:ruby-shell-backtick-execution","reason":"The patterns- prefix is a Markdown table label enclosed in backticks. It is not passed to a shell or interpreter.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:39:ruby-shell-backtick-execution","reason":"The react19- label identifies a documentation category. Its backticks are Markdown formatting, not command substitution.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:45:ruby-shell-backtick-execution","reason":"The inline code span names the architecture-avoid-boolean-props rule. The surrounding prose recommends composition without invoking external commands.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:47:ruby-shell-backtick-execution","reason":"The backtick span identifies the architecture-compound-components rule. It is a documentation identifier, not executable shell content.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:52:ruby-shell-backtick-execution","reason":"The state-decouple-implementation name is formatted as inline code. This reference describes provider responsibilities and contains no command.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:54:ruby-shell-backtick-execution","reason":"The backticks surround the state-context-interface rule identifier. The accompanying text describes a React context contract, not external execution.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:56:ruby-shell-backtick-execution","reason":"The state-lift-state identifier appears as Markdown inline code. The recommendation concerns provider state sharing and does not invoke a shell.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:60:ruby-shell-backtick-execution","reason":"The patterns-explicit-variants name identifies a component design rule. Backticks provide formatting only.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:62:ruby-shell-backtick-execution","reason":"The patterns-children-over-render-props name is a documentation identifier. No interpreter or external command consumes the text.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:69:ruby-shell-backtick-execution","reason":"The backtick spans format a rule name and React API identifiers. The line recommends React API usage, not shell execution.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:75:ruby-shell-backtick-execution","reason":"The triple backticks open a Markdown code fence containing two relative documentation paths. These paths are reading examples, not executable commands.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:78:ruby-shell-backtick-execution","reason":"The triple backticks close a documentation path example, and later backticks format AGENTS.md. Neither construct invokes Ruby or a shell.","verdict":"false_positive","confidence":0.99},{"id":"blocker:SKILL.md:17:system-reconnaissance","reason":"The introduction describes React composition and avoiding boolean props. It does not instruct the agent to gather host information.","verdict":"false_positive","confidence":0.99}],"semantic_findings":[],"subject_marketplace_commit_sha":"1f79e59ae427a74eab604c013e03b61f04634721","subject_content_hash":"e38e0eaa609316b10423a9a138ed95e35099accd3f735585295c8a8f165c28a3","subject_tree_hash":"144b5f15908f5bc887888c7f62fcf778a8d79a9dc22fdd45669e21216c9ade68","subject_plugin_path":"skills/vercel-labs/vercel-composition-patterns","audit_payload_hash":"dd020df6a4cb2d054824d67e54e98bd5","confirmed_risk_level":"safe","scanner_version":"3.0.0","policy_version":"skillstore-security-audit-policy-v1","subject":{"marketplaceCommitSha":"1f79e59ae427a74eab604c013e03b61f04634721","contentHash":"e38e0eaa609316b10423a9a138ed95e35099accd3f735585295c8a8f165c28a3","treeHash":"144b5f15908f5bc887888c7f62fcf778a8d79a9dc22fdd45669e21216c9ade68","pluginPath":"skills/vercel-labs/vercel-composition-patterns","auditPayloadHash":"dd020df6a4cb2d054824d67e54e98bd5"},"scannerVersion":"3.0.0","policyVersion":"skillstore-security-audit-policy-v1"},"auditTranslation":null,"localization":{"requestedLocale":"en","contentLocale":"en","availableLocales":["en"],"fallbackToEnglish":false},"attestation":{"availability":"issued","url":"/api/skills/vercel-labs-vercel-composition-patterns/audits/5/attestation","status":"active"},"trust":{"publicState":"public","auditState":"complete","auditCurrentness":null,"confirmedRiskLevel":"safe","confirmedFindingCount":0,"capabilityReviewCount":0,"needsReviewCount":0,"falsePositiveCount":0,"agentAutoInstallPolicy":"allowed","manualInstallPolicy":"allowed","artifactSignatureState":"available","attestationState":"active","verificationState":"not_verified"},"isLatest":true}}