Skills
skills/cedmandocdoc/awesome-skills/building-react-native-application/Gen Agent Trust Hub

building-react-native-application

Fail

Audited by Gen Agent Trust Hub on May 12, 2026

Risk Level: HIGHREMOTE_CODE_EXECUTIONEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
  • [REMOTE_CODE_EXECUTION]: The utility script scripts/add-registry-component.js fetches JSON data from user-provided URLs and uses it to write new source code files directly into the src/ui/ directory. Furthermore, it automatically parses a list of dependencies from the fetched JSON and installs them using the local package manager (npm, pnpm, yarn, or bun). This creates a path for an attacker to deliver and execute malicious code by tricking a user or the agent into using a malicious registry URL.
  • [COMMAND_EXECUTION]: The add-registry-component.js script employs child_process.execFileSync to execute shell commands, including shadcn@latest view and various package manager installation commands. These executions are driven by external data retrieved from remote URLs.
  • [EXTERNAL_DOWNLOADS]: The skill facilitates downloading external content through the registry component script and encourages the installation of additional remote skills via npx skills add commands mentioned in SKILL.md.
Recommendations
  • AI detected serious security threats
Audit Metadata
Risk Level
HIGH
Analyzed
May 12, 2026, 11:26 AM