react-doctor
Warn
Audited by Gen Agent Trust Hub on Jul 14, 2026
Risk Level: MEDIUMCOMMAND_EXECUTIONEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTION
Full Analysis
- [COMMAND_EXECUTION]: User-supplied input from
$ARGUMENTSis interpolated directly into a shell command (bunx -y react-doctor@latest {target} ...). This pattern is vulnerable to command injection if the input path contains shell metacharacters such as semicolons, pipes, or backticks. - [EXTERNAL_DOWNLOADS]: The skill uses
bunx -yto automatically fetch and install the latest version of thereact-doctorpackage from the public npm registry during execution. This introduces a supply chain risk by relying on an unpinned, third-party dependency from a source that is not categorized as a trusted vendor. - [REMOTE_CODE_EXECUTION]: By downloading and executing the
react-doctorpackage at runtime, the skill performs remote code execution. This process is triggered automatically during the 'Scan' phase and involves running external code within the agent's environment.
Audit Metadata