Agent skill · Audited from source
building-components
skill · vercel/components.buildNOASSERTION licenceAudited 20 Oct 2026 · source 0c1faa40500d
Is it safe? Yes — SAFE, grade B (89/100). We read this skill's source at commit 0c1faa40500d and found no filesystem, network or shell access and no hard-coded secrets. What it does: Guide for building modern, accessible, and composable UI components. Use when building new components, implementing accessibility, creating composable APIs, setting up design tokens, publishing to npm/registry, or…
Cite
Cite this page
ModelsAtlas. “building-components (vercel/components.build)”. Retrieved 20 Oct 2026. https://modelsatlas.com/skills/vercel/building-components
Trust audit
Audit 0.4.1 · source read 20 Oct 2026
SAFE means nothing in the source contradicts what the skill says it does. Grade B is shared by 13,985 of 14,816 audited skills.
What the source does
- FilesystemNone observedNo reads or writes in the source
- NetworkNone observedNo outbound calls in the source
- ShellNone observedNo commands run in the source
- DependenciesPinnedNothing floats
- SecretsNone foundNo keys in source
Five audit layers
| Layer | What we check | Result | Findings |
|---|---|---|---|
L0 Provenance | Repo owner, licence, archive status, activity | PASS | 0 |
L1 Static source | Secrets, path traversal, supply chain, hidden code | NA | 0 |
L2 Instructions | Prompt injection, authority framing, hidden directives | PASS | 0 |
L3 Inventory | The files and declarations match the source | PASS | 0 |
L4 Sandbox | Run in isolation and watch behaviour | SKIPPED why | 0 |
Gates applied: no behavioural pass.
Findings (0)
No findings at any severity. We re-audit when the source changes.
Audit 0.4.1 · source sha 0c1faa40500d · 20 Oct 2026Report an issue or request a re-scan
Provenance
Who published it, and what the verdict is pinned to
- Publishervercel GitHub organizationOwner of the repository this skill is read from
- Source foldervercel/components.build/skills/building-componentsThe exact folder we audited
- LicenceNOASSERTIONAs the repository states it
- Commit pinned for this verdict0c1faa40500dA new audit runs when the source changes
- Repository statusNot archivedLast push 61 days ago
- Sandboxed runNot runSkills are read, not executed; layer L4 is skipped
What it tells the agent
Full source on GitHub ↗Its description: Guide for building modern, accessible, and composable UI components. Use when building new components, implementing accessibility, creating composable APIs, setting up design tokens, publishing to npm/registry, or…
--- name: building-components description: Guide for building modern, accessible, and composable UI components. Use when building new components, implementing accessibility, creating composable APIs, setting up design tokens, publishing to npm/registry, or writing component documentation. --- # Building Components ## When to use this skill Use when the user is: - Building new UI components (primitives, components, blocks, templates) - Implementing accessibility features (ARIA, keyboard navigation, focus management) - Creating composable component APIs (slots, render props, controlled/uncontrolled state) - Setting up design tokens and theming systems - Publishing components to npm or a registry - Writing component documentation - Implementing polymorphism or as-child patterns - Working with data attributes for styling/state ## References - [definitions.mdx](./references/definitions.mdx) - Artifact taxonomy (primitives, components, blocks, templates) - [principles.mdx](./references/principles.mdx) - Core principles for component design - [accessibility.mdx](./references/accessibility.mdx) - ARIA, keyboard navigation, WCAG compliance - [composition.mdx](./references/composition.mdx) - Composable component patterns - [as-child.mdx](./references/as-child.mdx) - The as-child pattern for element polymorphism - [polymorphism.mdx](./references/polymorphism.mdx) - Polymorphic component patterns - [types.mdx](./references/types.mdx) - TypeScript typing patterns for components - [state.mdx](./references/state.mdx) - Controlled vs uncontrolled state management - [data-attributes.mdx](./references/data-attributes.mdx) - Using data attributes for styling and state - [design-tokens.mdx](./references/design-tokens.mdx) - Design token systems and theming - [styling.mdx](./references/styling.mdx) - Component styling approaches - [registry.mdx](./references/registry.mdx) - shadcn-style registry distribution - [npm.mdx](./references/npm.mdx) - Publishing components to npm - [marketplaces.mdx](./references/marketplaces.mdx) - Component marketplace distribution - [docs.mdx](./references/docs.mdx) - Writing component documentation
Excerpt, first 2,150 characters of SKILL.md, verbatim from the audited commit. It is text from someone else’s repository, quoted so you can judge it before your agent reads it.
Install
Pinned to the audited commit 0c1faa4
npm install <your-component-name> npm install @acme/ui-components npm install @radix-ui/react-slot npm install @radix-ui/react-use-controllable-state
git clone https://github.com/vercel/components.build git -C components.build checkout 0c1faa40500d
Commands as the repository documents them: shown, never run by us. Our verdict covers commit 0c1faa40500d only.
Works in which agents?
What its own text says, not a test
| Agent | Status | More |
|---|---|---|
| Cursor | Mentioned in its text, not tested | Skills for Cursor · About Cursor |
Audit history
Every audit, every source change
- ✓SAFE B 89 / 100
first audit · source
0c1faa40500d
README badge
For maintainers · shows the latest audit
[](https://modelsatlas.com/skills/vercel/building-components/)
The badge shows our verdict and grade for this skill, and links back to this page. It changes when the audit does.
Similar skills
magicuidesign/magicui
Use this skill when users want to add, customize, or troubleshoot Magic UI components in React/Next.js projects. It covers component selection, shadcn registry installation (`@magicui/*`), integration patterns, and…
vercel/next.js
Verify Next.js runtime behavior after editing app code. Use this skill to confirm a change actually works in a running app — not just that it compiles or type-checks. Combines /_next/mcp (Next.js's view) with…
vercel/next.js
Optimize the meaningful UI available immediately from a Next.js route on an initial load (hard navigation) or named client-side navigation (soft navigation). Encode the goal as a failing @next/playwright instant() e2e…
vercel/next.js
Turn on Cache Components in a Next.js app and resolve the blocking routes it surfaces. Use when the user wants to enable, adopt, or migrate to Cache Components, flip the `cacheComponents` flag, work through a flood of…
shadcn/ui
Manages shadcn components and projects — adding, searching, fixing, debugging, styling, and composing UI, including chat interfaces. Provides project context, component docs, and usage examples. Applies when working…
shadcn/ui
Migrates React projects and components from Radix UI to Base UI. Use when asked to migrate from radix, move to base-ui, convert radix primitives, or switch a shadcn project's base library. Handles single components…
Add this badge to your README
[](https://modelsatlas.com/skills/vercel/building-components/)
<a href="https://modelsatlas.com/skills/vercel/building-components/"><img src="https://modelsatlas.com/skills/vercel/building-components/badge.svg" alt="ModelsAtlas: SAFE B"></a>
Questions about building-components
What does the building-components skill do?
Is building-components safe to install?
What can building-components access on my machine?
Which assistants does building-components work with?
How current is this page?
Sources
- github.com/vercel/components.build/tree/main/skills/building-com — the audited source at commit 0c1faa40500d and every finding aboveObserved · 20 Oct 2026
Spotted something wrong? Report a correction · Methodology
Keep going in your AI
Opens with this page as the source. We add nothing else to the prompt.
- What does the building-components skill do?
- Is building-components safe to install?
- What can building-components access on my machine?