react-doctor
Pass
Audited by Gen Agent Trust Hub on Sep 23, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes diagnostics from scanning a codebase which could contain instructions designed to influence the agent. Ingestion points: The agent captures and triages the full output of the command execution as described in SKILL.md. Boundary markers: No delimiters or ignore instructions are defined to separate tool output from codebase content. Capability inventory: The skill workflow implies file modification and command execution capabilities (fix validated issues and re-run checks). Sanitization: No sanitization is performed on the tool output before processing.
- [EXTERNAL_DOWNLOADS]: The skill downloads the 'react-doctor' package from the npm registry at runtime using npx.
- [COMMAND_EXECUTION]: Executes the shell command 'npx -y react-doctor@latest . --verbose' to perform codebase analysis.
Audit Metadata