react-modernization
Pass
Audited by Gen Agent Trust Hub on Jun 17, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill provides instructions and examples for executing shell commands to run codemods, specifically using tools like jscodeshift, npx react-codeshift, and npx codemod to automate code transformations.
- [EXTERNAL_DOWNLOADS]: The implementation playbook suggests using npm install and npx, which results in downloading packages from the public NPM registry at runtime.
- [PROMPT_INJECTION]: As the skill is designed to process external React codebases, there is an inherent surface for indirect prompt injection if the source code contains malicious instructions intended to influence the agent's behavior during the refactoring process.
- Ingestion points: The agent reads source files from the user's codebase as described in the implementation playbook.
- Boundary markers: No specific delimiters or safety instructions are defined to separate code from instructions within the processed files.
- Capability inventory: The skill has the capability to execute shell commands via npm, npx, and jscodeshift as described in resources/implementation-playbook.md.
- Sanitization: No explicit sanitization or validation of the processed source code is mentioned.
Audit Metadata