frontend-dev-guidelines
Pass
Audited by Gen Agent Trust Hub on Sep 20, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill's examples in
resources/complete-examples.md(Example 5) reference non-standard and suspicious packagesreact-hook-blogand@hookblog/resolvers/zod. These appear to be imitations of the industry-standardreact-hook-formand@hookform/resolvers/zodpackages used elsewhere in the skill (e.g.,resources/common-patterns.md). The presence of these unverifiable packages in a production-oriented guideline represents a supply chain risk. - [INDIRECT_PROMPT_INJECTION]: The skill includes code templates and instructions that deceptively substitute standard React/HTML elements and patterns with non-standard ones, such as using a
<blog>tag instead of<form>anduseBloginstead ofuseForm. This could cause an AI agent to generate incorrect or insecure code by following these inconsistent patterns. - Ingestion points:
resources/complete-examples.md(Example 5) provides code templates for implementation. - Boundary markers: Absent. The skill does not include instructions to ignore or validate embedded patterns.
- Capability inventory: The agent is tasked with generating and refactoring frontend code, including defining project dependencies.
- Sanitization: Absent. There is no validation to ensure standard libraries are used over the suspicious ones suggested.
Audit Metadata