react-scan
Pass
Audited by Gen Agent Trust Hub on Oct 12, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill provides instructions and automation scripts for diagnosing performance issues in React applications using the React Scan utility.
- [EXTERNAL_DOWNLOADS]: Fetches the React Scan library from the Unpkg CDN (e.g.,
https://unpkg.com/react-scan@0.5.7/dist/auto.global.js). Unpkg is a well-known service for distributing NPM packages. - [COMMAND_EXECUTION]: Executes a local Node.js script (
scripts/render-probe.mjs) which uses Playwright to automate browser interactions and capture performance metrics. - [DYNAMIC_EXECUTION]: The
render-probe.mjsscript utilizes Playwright'spage.addInitScriptandpage.evaluatefunctions to inject and execute profiling logic within the browser environment. It also dynamically imports user-provided interaction scripts via the--stepsflag. - [INDIRECT_PROMPT_INJECTION]: The skill ingests performance data and component metadata from external React applications. While this data is technically untrusted, it is processed as structured performance metrics.
- Ingestion points: Data is collected through
onRendercallbacks and browser evaluation results inscripts/render-probe.mjs. - Boundary markers: None specifically identified for data ingestion.
- Capability inventory: Subprocess execution via
nodefor running the profiling script. - Sanitization: The data is aggregated into structured JSON reports for analysis.
Audit Metadata