ai-elements
github.com/vercel/ai-elements
Scanned Thu, 28 May 2026 16:55:47 GMT
Scan ID crawl-vzh9licwlibvnixjt09lo8nd · 2ms
B
SCORE 75 / 100
Verdict: Safe to install
3 medium findings.
This skill ships without a capability manifest plus 2 other issues listed below.
0 critical0 high3 medium9 rules passed
Why grade B?
score · 75 / 100The current grade reflects 3 medium findings (3+ MEDs → B).
0 CRIT0 HIGH3 MED0 LOW
To reach a higher grade
- AReach Atarget score 95
Resolve 1 of 3 MED (cap is 2).
Thresholds are documented at /docs/grading. Source-of-truth is the grade() function in @skillox/scanner.
Findings · ordered by severity
medNo capability manifest declaredThe skill ships without a `manifest.yaml` or `capabilities` block in its frontmatter. Without a manifest, the runtime cannot enforce what this skill is permitted to do.rule: no-manifest▾
No capability manifest declared
The skill ships without a `manifest.yaml` or `capabilities` block in its frontmatter. Without a manifest, the runtime cannot enforce what this skill is permitted to do.
rule:
no-manifestmedLink text shows "node.js" but points at nodejs.orgThe visible link text contains the domain `node.js`, but the URL actually targets `nodejs.org`. This is a phishing/smuggling pattern — the reader sees one host, the agent fetches another. Either update the text or the URL so they match.▾
Link text shows "node.js" but points at nodejs.org
The visible link text contains the domain `node.js`, but the URL actually targets `nodejs.org`. This is a phishing/smuggling pattern — the reader sees one host, the agent fetches another. Either update the text or the URL so they match.
16Before installing AI Elements, make sure your environment meets the following requirements:
17
18- [Node.js](https://nodejs.org/en/download/), version 18 or later← text→node.js · href→nodejs.org
19- A [Next.js](https://nextjs.org/) project with the [AI SDK](https://ai-sdk.dev/) installed.
20- [shadcn/ui](https://ui.shadcn.com/) installed in your project. If you don't have it installed, running any install command will automatically install it for you.
medLink text shows "next.js" but points at nextjs.orgThe visible link text contains the domain `next.js`, but the URL actually targets `nextjs.org`. This is a phishing/smuggling pattern — the reader sees one host, the agent fetches another. Either update the text or the URL so they match.▾
Link text shows "next.js" but points at nextjs.org
The visible link text contains the domain `next.js`, but the URL actually targets `nextjs.org`. This is a phishing/smuggling pattern — the reader sees one host, the agent fetches another. Either update the text or the URL so they match.
17
18- [Node.js](https://nodejs.org/en/download/), version 18 or later
19- A [Next.js](https://nextjs.org/) project with the [AI SDK](https://ai-sdk.dev/) installed.← text→next.js · href→nextjs.org
20- [shadcn/ui](https://ui.shadcn.com/) installed in your project. If you don't have it installed, running any install command will automatically install it for you.
21- We also highly recommend using the [AI Gateway](https://vercel.com/docs/ai-gateway) and adding `AI_GATEWAY_API_KEY` to your `env.local` so you don't have to use an API key from every provider. AI Gateway also gives $5 in usage per month so you can experiment with models. You can obtain an API key [here](https://vercel.com/d?to=%2F%5Bteam%5D%2F%7E%2Fai%2Fapi-keys&title=Get%20your%20AI%20Gateway%20key).
skillox.io/r/crawl-vzh9licwlibvnixjt09lo8nd