router-query-integration
Pass
Audited by Gen Agent Trust Hub on Sep 4, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [SAFE]: The skill consists of documentation and standard boilerplate code for React application development. A thorough review found no evidence of prompt injection, obfuscation, or malicious command execution.
- [INDIRECT_PROMPT_INJECTION]: The skill facilitates the ingestion of user-controlled data via route parameters and search queries, which is a common attack surface for indirect prompt injection. However, the skill provides mitigation patterns including schema validation.
- Ingestion points: URL parameters (
params.userId) and search parameters accessed viaRoute.useSearch()in the example components. - Boundary markers: Not explicitly implemented in the frontend logic for LLM context separation.
- Capability inventory: Limited to network data fetching via standard browser APIs; no access to shell commands or sensitive local files.
- Sanitization: Demonstrates the use of the
zodlibrary for search parameter validation and type enforcement.
Audit Metadata