building-react-web-application
Pass
Audited by Gen Agent Trust Hub on Oct 22, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [COMMAND_EXECUTION]: The skill includes helper scripts (
scripts/install-packages.cjsandscripts/run-package.cjs) that utilize Node.jschild_process.execFileSyncto execute shell commands. These are intended to automate project setup and dependency management by invoking standard package managers like npm, pnpm, yarn, and bun. - [EXTERNAL_DOWNLOADS]: The skill directs the agent to download and install multiple industry-standard libraries and development tools from the npm registry, including @tanstack/react-query, zod, tailwindcss, and various ESLint plugins.
- [DATA_EXPOSURE]: The skill includes proactive security guidance in
references/managing-environment.md, explicitly warning thatVITE_*environment variables are exposed in client bundles and instructing that secrets should be kept in server-side configurations or proxy patterns.
Audit Metadata