react
Pass
Audited by Gen Agent Trust Hub on Sep 15, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill provides boilerplate code for components that ingest data from external URLs (e.g.,
useFetchinresources/hooks-patterns.mdandDataFetcherinresources/component-patterns.md). This establishes an entry point for untrusted data that the agent might process if it uses these templates to fetch from attacker-controlled sources. - Ingestion points:
useFetch(url)andDataFetcher({ url })components which accept a URL parameter for network requests. - Boundary markers: None provided in the generic code templates; developers are expected to implement their own application-level security.
- Capability inventory: The components use the web
fetchAPI for network read operations. - Sanitization: The snippets show basic JSON parsing and state management; sanitization of the fetched data before rendering would depend on the specific implementation of the consumer component.
- [EXTERNAL_DOWNLOADS]: The documentation references
@tanstack/react-virtualinresources/performance.mdfor list virtualization. This is a well-known and trusted library within the React community used for optimizing large dataset rendering.
Audit Metadata