frontend-dev-guidelines
Warn
Audited by Gen Agent Trust Hub on Oct 6, 2026
Risk Level: MEDIUMOBFUSCATIONEXTERNAL_DOWNLOADSMETADATA_POISONING
Full Analysis
- [OBFUSCATION]: The documentation uses a systematic and deliberate string substitution pattern where the sequence 'form' is replaced with 'blog' across various technical terms. Examples include 'perblogance' for 'performance', 'transblogers' for 'transformers', and 'transblogation' for 'transformation'. This technique is characteristic of attempts to evade keyword-based security filters and automated analysis tools.
- [EXTERNAL_DOWNLOADS]: The resource files (specifically resources/complete-examples.md and resources/common-patterns.md) recommend the installation and use of unverifiable npm packages such as 'react-hook-blog' and '@hookblog/resolvers/zod'. These packages appear to be deceptive clones of the legitimate 'react-hook-form' and '@hookform/resolvers/zod' libraries. Recommending unvetted third-party packages introduces a significant supply chain risk.
- [METADATA_POISONING]: The skill presents these non-standard packages and patterns as 'modern patterns' and recommended 'best practices' for React development. By embedding these deceptive recommendations within otherwise professional-looking guidelines, the skill may mislead developers into adopting malicious or insecure dependencies.
Audit Metadata