react-guide
Pass
Audited by Gen Agent Trust Hub on Aug 20, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill provides structured technical documentation and guidelines for React development without any malicious instructions or safety bypasses.\n- [DYNAMIC_EXECUTION]: Evaluation scripts within the evals directory utilize dynamic import() to load and exercise fixture code. This is an expected pattern for validation logic and is confined to the testing environment.\n- [INDIRECT_PROMPT_INJECTION]: The skill processes React source code and configuration files. It incorporates defensive instructions, such as treating OWNERSHIP.md and package.json as authoritative sources of truth, which mitigates risks associated with untrusted data ingestion. Evidence Chain:\n
- Ingestion points: React source code (.jsx, .mjs) and configuration files (.json, .md) read from the workspace.\n
- Boundary markers: Instructions explicitly mandate using OWNERSHIP.md and package.json as the authoritative source of truth.\n
- Capability inventory: Agent tools for file system access and potentially shell command execution.\n
- Sanitization: No explicit sanitization is performed on ingested code, but agent logic is governed by strict React-specific technical criteria.
Audit Metadata