react-scan

Pass

Audited by Gen Agent Trust Hub on Oct 12, 2026

Risk Level: SAFE
Full Analysis
  • [SAFE]: The skill provides instructions and automation scripts for diagnosing performance issues in React applications using the React Scan utility.
  • [EXTERNAL_DOWNLOADS]: Fetches the React Scan library from the Unpkg CDN (e.g., https://unpkg.com/react-scan@0.5.7/dist/auto.global.js). Unpkg is a well-known service for distributing NPM packages.
  • [COMMAND_EXECUTION]: Executes a local Node.js script (scripts/render-probe.mjs) which uses Playwright to automate browser interactions and capture performance metrics.
  • [DYNAMIC_EXECUTION]: The render-probe.mjs script utilizes Playwright's page.addInitScript and page.evaluate functions to inject and execute profiling logic within the browser environment. It also dynamically imports user-provided interaction scripts via the --steps flag.
  • [INDIRECT_PROMPT_INJECTION]: The skill ingests performance data and component metadata from external React applications. While this data is technically untrusted, it is processed as structured performance metrics.
  • Ingestion points: Data is collected through onRender callbacks and browser evaluation results in scripts/render-probe.mjs.
  • Boundary markers: None specifically identified for data ingestion.
  • Capability inventory: Subprocess execution via node for running the profiling script.
  • Sanitization: The data is aggregated into structured JSON reports for analysis.
Audit Metadata
Risk Level
SAFE
Analyzed
Oct 12, 2026, 05:38 PM