react-principles
Pass
Audited by Gen Agent Trust Hub on Oct 26, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill is intended to be used by an agent to review and refactor external code files (.ts, .tsx, .js, .jsx). This processing of untrusted data represents an attack surface for indirect prompt injection.
- Ingestion points: The skill description in SKILL.md specifies that it should be used when writing, reviewing, or refactoring React components and hooks in .ts, .tsx, .js, and .jsx files.
- Boundary markers: There are no explicit instructions or delimiters defined to prevent the agent from following instructions potentially embedded in the source code being analyzed.
- Capability inventory: The skill involves reviewing and refactoring tasks, which typically require file system read and write access through agent tools.
- Sanitization: The guidelines do not include steps for sanitizing or escaping content found within the external code files before processing.
Audit Metadata