web-routing-react-router
Pass
Audited by Gen Agent Trust Hub on Apr 7, 2026
Risk Level: SAFEPROMPT_INJECTION
Full Analysis
- [PROMPT_INJECTION]: The skill facilitates the ingestion of untrusted data from external API endpoints via route loaders and actions, which is subsequently rendered in the UI (e.g., using
useLoaderDatainexamples/data-loading.md). This creates an attack surface for indirect prompt injection if the API content is attacker-controlled. - Ingestion points: The skill utilizes
useLoaderData,useActionData,useSearchParams, anduseOutletContextto ingest external or user-controlled data into the agent's rendering context (documented inSKILL.mdand all example files). - Boundary markers: No delimiters or specific instructions to ignore embedded prompts are present in the provided code examples.
- Capability inventory: The skill is configured to perform network requests via
fetchand manage application navigation viaredirect,useNavigate, andLink. - Sanitization: The examples do not demonstrate explicit validation or sanitization of the fetched data before it is rendered to the components.
Audit Metadata