beforemerge-react-review
Pass
Audited by Gen Agent Trust Hub on Oct 4, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill provides a knowledge base of React code review rules in markdown format. It does not contain executable code, persistent triggers, or dynamic context injections.
- [EXTERNAL_DOWNLOADS]: The documentation references well-known, industry-standard libraries such as
dompurify,zod,react-window, and@tanstack/react-virtualas recommended solutions for security and performance issues. These are trusted resources and do not represent a security risk. - [PROMPT_INJECTION]: The instructions are clearly defined and focused on aiding an AI agent in performing code reviews. There are no attempts to override safety filters, bypass instructions, or extract system prompts.
- [DATA_EXFILTRATION]: No patterns of data exfiltration, hardcoded credentials, or unauthorized access to sensitive file paths were found. Network examples in the code snippets are generic and used for educational purposes.
- [INDIRECT_PROMPT_INJECTION]: While the skill is designed to analyze potentially untrusted source code, it acts as a passive knowledge base. It does not include automated tool execution logic that would create a high-risk attack surface for indirect prompt injection.
Audit Metadata