react-expert
Pass
Audited by Gen Agent Trust Hub on Jun 17, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill uses shell commands like
npm list,grep,find, andnode -eto inspect the local development environment and identify React components or configuration patterns. - [EXTERNAL_DOWNLOADS]: The skill executes
npx eslint, which may trigger a download of the ESLint tool and associated plugins from the official npm registry if they are missing from the local environment. - [PROMPT_INJECTION]: The skill ingests untrusted data from the local filesystem during code analysis, creating a surface for indirect prompt injection.
- Ingestion points: Source code files in the
src/directory are read usinggrepandfindcommands to diagnose issues. - Boundary markers: No explicit boundary markers or instructions to ignore embedded prompts are provided when reading files.
- Capability inventory: The skill has the ability to execute shell commands (
npm,grep,find) and perform file system analysis. - Sanitization: No content sanitization or escaping is performed on the code content before it is processed by the agent.
Audit Metadata