react-container-presentation-component
Pass
Audited by Gen Agent Trust Hub on Oct 26, 2026
Risk Level: SAFECOMMAND_EXECUTIONDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill invokes local project scripts including 'npm run build', 'npm run lint', and 'npm run storybook' to validate generated code quality and functionality.
- [DYNAMIC_EXECUTION]: The skill generates TypeScript and SCSS source files based on user-provided names and templates, which are then immediately processed or executed by the project's build and storybook environments.
- [INDIRECT_PROMPT_INJECTION]: The skill presents an attack surface by ingesting untrusted user input via the 'componentName' and 'type' arguments. Ingestion points: The componentName and type arguments defined in the SKILL.md frontmatter. Boundary markers: No explicit delimiter markers are used when interpolating these values into generated code. Capability inventory: The skill performs file system writes in 'src/components/', modifies existing source code, and executes shell commands. Sanitization: The skill mitigates risks by enforcing PascalCase validation for component names and using interactive confirmation via 'ask_user' before overwriting files or running validation scripts.
Audit Metadata