fingerprint-react
Pass
Audited by Gen Agent Trust Hub on Oct 4, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill requires the installation of the
@fingerprint/reactpackage from the NPM registry. This is a standard dependency for the integration and originates from the documented vendor. - [COMMAND_EXECUTION]: Instructions include using
pnpm approve-buildsto permit the execution of apostinstallscript for the@fingerprint/reactpackage. This is a standard administrative action within the pnpm package manager to handle restricted build environments. - [INDIRECT_PROMPT_INJECTION]: The skill facilitates the ingestion of visitor identification data, which creates a theoretical surface for indirect prompt injection if downstream systems process this data as natural language instructions.
- Ingestion points: The
useVisitorDatahook insnippets/use-visitor-data.jsxfetchesvisitor_idandevent_idfrom external identification services. - Boundary markers: None present in the code snippets.
- Capability inventory: The skill uses
fetchto send data to an internal/api/loginendpoint. - Sanitization: The identification data is interpolated directly into a JSON request body without explicit sanitization or validation in the provided example snippet.
Audit Metadata