reaxuse-functions
Pass
Audited by Gen Agent Trust Hub on Sep 11, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADSDYNAMIC_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill documentation describes functions that process untrusted data from external sources, which represents a potential attack surface for indirect prompt injection if the AI agent processes the results.
- Ingestion points:
useFetch(references/useFetch.md) handles network responses;useStorage(references/useStorage.md) reads from LocalStorage/SessionStorage;useClipboard(references/useClipboard.md) reads from the system clipboard. - Boundary markers: No explicit boundary markers or 'ignore embedded instructions' warnings are mentioned for handling the content of fetched or read data.
- Capability inventory:
useScriptTag(references/useScriptTag.md) can inject and execute remote scripts;useStyleTag(references/useStyleTag.md) can inject CSS;useStorageanduseCookiescan persist data. - Sanitization: Hooks like
useFetchprovideafterFetchandonFetchErrorinterceptors that can be used for sanitization, but standard behavior relies on user-defined implementation. - [EXTERNAL_DOWNLOADS]: The documentation provides instructions to install several standard third-party libraries and references the author's GitHub repository.
- Instructs users to install well-known NPM packages:
async-validator,axios,change-case,universal-cookie,drauu,focus-trap,fuse.js,idb-keyval,jwt-decode,nprogress,qrcode,sortablejs,firebase, andrxjs. - References the verified author's repository at
https://github.com/hairyf/reaxuseand official documentation for Firebase and Web APIs. - [DYNAMIC_EXECUTION]: Several hooks provide utilities for programmatic execution of code or injection of content into the browser environment.
useScriptTag(references/useScriptTag.md) programmatically appends<script>elements to the document head.useStyleTag(references/useStyleTag.md) injects<style>blocks into the head.useWebWorkerFn(references/useWebWorkerFn.md) allows running functions in background Web Workers.- These features are standard for a developer-focused utility library and are presented neutrally.
Audit Metadata