fingerprint-react

Pass

Audited by Gen Agent Trust Hub on Oct 4, 2026

Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The skill requires the installation of the @fingerprint/react package from the NPM registry. This is a standard dependency for the integration and originates from the documented vendor.
  • [COMMAND_EXECUTION]: Instructions include using pnpm approve-builds to permit the execution of a postinstall script for the @fingerprint/react package. This is a standard administrative action within the pnpm package manager to handle restricted build environments.
  • [INDIRECT_PROMPT_INJECTION]: The skill facilitates the ingestion of visitor identification data, which creates a theoretical surface for indirect prompt injection if downstream systems process this data as natural language instructions.
  • Ingestion points: The useVisitorData hook in snippets/use-visitor-data.jsx fetches visitor_id and event_id from external identification services.
  • Boundary markers: None present in the code snippets.
  • Capability inventory: The skill uses fetch to send data to an internal /api/login endpoint.
  • Sanitization: The identification data is interpolated directly into a JSON request body without explicit sanitization or validation in the provided example snippet.
Audit Metadata
Risk Level
SAFE
Analyzed
Oct 4, 2026, 03:14 PM