react-native
Fail
Audited by Gen Agent Trust Hub on Oct 4, 2026
Risk Level: CRITICALREMOTE_CODE_EXECUTIONEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
- [REMOTE_CODE_EXECUTION]: The file
references/js-measure-fps.mdinstructs the user or agent to install a performance tool by piping a remote script directly into the shell using the commandcurl https://get.flashlight.dev | bash. This represents a high-risk remote code execution (RCE) vector, as it allows arbitrary code execution from a non-whitelisted third-party source without integrity verification. - [EXTERNAL_DOWNLOADS]: The skill recommends downloading and installing various third-party tools and configurations from sources outside of the explicitly trusted vendor list, including dependencies from
flashlight.devandspotify(Ruler plugin). - [COMMAND_EXECUTION]: The guide provides multiple commands for building native applications, analyzing binaries, and modifying build configurations (e.g., Gradle scripts, CocoaPods), which grant the agent significant control over the local development environment and system resources.
Recommendations
- AI detected serious security threats
Audit Metadata