reaxuse-functions

Pass

Audited by Gen Agent Trust Hub on Sep 11, 2026

Risk Level: SAFEINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADSDYNAMIC_EXECUTION
Full Analysis
  • [INDIRECT_PROMPT_INJECTION]: The skill documentation describes functions that process untrusted data from external sources, which represents a potential attack surface for indirect prompt injection if the AI agent processes the results.
  • Ingestion points: useFetch (references/useFetch.md) handles network responses; useStorage (references/useStorage.md) reads from LocalStorage/SessionStorage; useClipboard (references/useClipboard.md) reads from the system clipboard.
  • Boundary markers: No explicit boundary markers or 'ignore embedded instructions' warnings are mentioned for handling the content of fetched or read data.
  • Capability inventory: useScriptTag (references/useScriptTag.md) can inject and execute remote scripts; useStyleTag (references/useStyleTag.md) can inject CSS; useStorage and useCookies can persist data.
  • Sanitization: Hooks like useFetch provide afterFetch and onFetchError interceptors that can be used for sanitization, but standard behavior relies on user-defined implementation.
  • [EXTERNAL_DOWNLOADS]: The documentation provides instructions to install several standard third-party libraries and references the author's GitHub repository.
  • Instructs users to install well-known NPM packages: async-validator, axios, change-case, universal-cookie, drauu, focus-trap, fuse.js, idb-keyval, jwt-decode, nprogress, qrcode, sortablejs, firebase, and rxjs.
  • References the verified author's repository at https://github.com/hairyf/reaxuse and official documentation for Firebase and Web APIs.
  • [DYNAMIC_EXECUTION]: Several hooks provide utilities for programmatic execution of code or injection of content into the browser environment.
  • useScriptTag (references/useScriptTag.md) programmatically appends <script> elements to the document head.
  • useStyleTag (references/useStyleTag.md) injects <style> blocks into the head.
  • useWebWorkerFn (references/useWebWorkerFn.md) allows running functions in background Web Workers.
  • These features are standard for a developer-focused utility library and are presented neutrally.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 11, 2026, 04:00 PM