react-expert

Pass

Audited by Gen Agent Trust Hub on Jun 17, 2026

Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSPROMPT_INJECTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill uses shell commands like npm list, grep, find, and node -e to inspect the local development environment and identify React components or configuration patterns.
  • [EXTERNAL_DOWNLOADS]: The skill executes npx eslint, which may trigger a download of the ESLint tool and associated plugins from the official npm registry if they are missing from the local environment.
  • [PROMPT_INJECTION]: The skill ingests untrusted data from the local filesystem during code analysis, creating a surface for indirect prompt injection.
  • Ingestion points: Source code files in the src/ directory are read using grep and find commands to diagnose issues.
  • Boundary markers: No explicit boundary markers or instructions to ignore embedded prompts are provided when reading files.
  • Capability inventory: The skill has the ability to execute shell commands (npm, grep, find) and perform file system analysis.
  • Sanitization: No content sanitization or escaping is performed on the code content before it is processed by the agent.
Audit Metadata
Risk Level
SAFE
Analyzed
Jun 17, 2026, 02:08 AM
Security Audit — agent-trust-hub — react-expert