vercel-composition-patterns — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited vercel-composition-patterns (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
This skill is the discipline of growing a React component's API by composition instead of by accumulating boolean flags. Its central move is the boolean state-explosion audit: before any prop is added, you count how many booleans a component already has, how many combined states that produces (2ⁿ), and how many of those combinations are impossible, unsupported, or contradictory — because the answer almost always reveals that the component's real shape is a small set of named valid variants, not the cartesian product of its flags. From that audit follow the patterns that scale: compound components (a family like Tabs.List / Tabs.Tab / Tabs.Panel that share state through a context provider rather than through prop drilling), explicit variant components (named modes instead of flag combinations), children-over-render-props (composing structure through children rather than renderX callbacks), and the provider state/actions/meta interface (one place owns the canonical state, the actions that mutate it, and the derived meta, decoupling consumers from how state is managed). The skill also carries the React 19 API migration — ref as a regular prop instead of forwardRef, and use() in place of useContext(). The throughline is restraint enforced by measurement: provider boundaries matter more than visual nesting, and a boolean prop is a cost to be justified against the audit, never a default reflex.
React component composition patterns that prevent boolean prop proliferation: compound components (shared-context child families), explicit variant components, children-over-render-props, the context provider state/actions/meta interface, the boolean state explosion audit, and the React 19 API migration (ref as a regular prop instead of forwardRef, use() over useContext()). Covers the refactor playbook from flag inventory through impossible-state deletion and variant extraction to provider-based composition.
The rule categories, in priority order:
| Priority | Category | Impact | Prefix |
|---|---|---|---|
| 1 | Component Architecture | HIGH | architecture- |
| 2 | State Management | MEDIUM | state- |
| 3 | Implementation Patterns | MEDIUM | patterns- |
| 4 | React 19 APIs | MEDIUM | react19- |
1. Component Architecture (HIGH)
architecture-avoid-boolean-props — don't add boolean props to customize behavior; use composition.architecture-compound-components — structure complex components with shared context (a parent provides state; named children consume it).architecture-boolean-state-audit — count reachable vs impossible states before adding props.2. State Management (MEDIUM)
state-decouple-implementation — the provider is the only place that knows how state is managed.state-context-interface — define a generic interface with state, actions, and meta for dependency injection.state-lift-state — move state into provider components so siblings can access it without prop drilling.3. Implementation Patterns (MEDIUM)
patterns-explicit-variants — create explicit variant components instead of boolean modes.patterns-children-over-render-props — use children for composition instead of renderX props.4. React 19 APIs (MEDIUM)
⚠️ React 19+ only. Skip this section on React 18 or earlier.
react19-no-forwardref — don't use forwardRef; pass ref as a regular prop, and use use() instead of useContext().Before adding a new prop or mode, answer:
If a boolean produces impossible combinations, stop and refactor the API.
state, actions, and meta.Boolean props are technical debt that compounds exponentially. Every boolean added to a component doubles the state space, and most of those combined states are impossible or unsupported. Agents default to adding "just one more boolean" because it is the fastest path — this skill forces the discipline of auditing the state explosion first. Without it, agents regularly create components with five-plus booleans and fragile if/else rendering chains that break on edge-case combinations.
Composition is the antidote: build flexible, maintainable React components by using compound components, lifting state, and composing internals rather than toggling behavior through flags. Provider boundaries matter more than visual nesting — the provider owns state, actions, and meta, and consumers compose around that contract. These patterns make codebases easier for both humans and AI agents to work with as they scale, because the valid configurations stay explicit and enumerable instead of hiding inside a cartesian product of flags.
The core mandate is short and strict:
After applying this skill, verify:
children composition, not renderX props.ref as a regular prop and uses use() instead of useContext().| Instead of this skill | Use | Why |
|---|---|---|
| React render-performance optimization (memoization, suspense, re-render profiling) | react-best-practices | The performance skill owns rendering optimization; this skill owns API shape, not render speed. |
| Visual component design and styling | a design/UI skill (e.g. design-system-architecture) | This skill covers the component's API surface, not its visual appearance, spacing, or tokens. |
| Next.js routing and server components | a Next.js framework skill | The framework skill owns routing and server-component patterns; this skill is React-composition-level, framework-agnostic. |
| A general behavior-preserving structural cleanup with no specific composition target | refactor | refactor owns generic restructuring; reach for this skill when the target API shape is specifically a composition pattern. |
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.