react-hook-form-zod
Warn
Audited by Gen Agent Trust Hub on Sep 4, 2026
Risk Level: MEDIUMMETADATA_POISONINGEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [METADATA_POISONING]: The skill contains fabricated metadata, including verification dates in the future (January 2026) and references to non-existent GitHub issues (e.g., react-hook-form issues #13109, #13129, #13156). This misleads users about the validity of the technical guidance provided.\n- [EXTERNAL_DOWNLOADS]: The skill instructs users to install specific versions of packages that do not exist in official registries, such as
zod@4.3.5andreact-hook-form@7.71.1. Recommending non-existent version numbers creates a supply chain risk (dependency confusion) if those versions are later registered by attackers.\n- [INDIRECT_PROMPT_INJECTION]: The skill provides templates for building complex forms that ingest untrusted user input. While the skill emphasizes validation, the interpolation of external data into the agent's context through these form patterns creates an attack surface for indirect prompt injection.\n- [METADATA_POISONING]: The skill claims to prevent documented issues associated with future versions of libraries that have not yet been released, providing false technical context for the developer.
Audit Metadata