dt-setup-react-native
Pass
Audited by Gen Agent Trust Hub on Aug 14, 2026
Risk Level: SAFE
Full Analysis
- [UNVERIFIABLE_DEPENDENCIES_AND_REMOTE_CODE_EXECUTION]: The skill installs the
@dynatrace/react-native-pluginpackage from the public npm registry and executes thenpx instrumentDynatraceCLI tool. These are standard procedures for integrating the Dynatrace SDK and are scoped to the official vendor resource provided by the skill author. - [DATA_EXPOSURE_AND_EXFILTRATION]: The skill reads project-level configuration files such as
package.json,babel.config.js, anddynatrace.config.js. This access is required to identify the existing project state and apply the correct instrumentation settings. The configuration values involved (e.g., applicationId, beaconUrl) are necessary identifiers for the monitoring service and are not exfiltrated to any unauthorized external domains. - [INDIRECT_PROMPT_INJECTION]: The skill has a limited indirect prompt injection surface as it processes local project files to drive the configuration workflow.
- Ingestion points: Reads
package.json,babel.config.js, anddynatrace.config.jsin Steps 1, 3, 5, 6, and 8. - Boundary markers: Absent.
- Capability inventory: Executes
npm install,pod install, andnpx instrumentDynatrace(Steps 3, 4, and 7). - Sanitization: The skill performs specific configuration updates based on defined keys rather than executing arbitrary content from these files.
- Ingestion points: Reads
Audit Metadata