improve-react
Pass
Audited by Gen Agent Trust Hub on Aug 5, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [COMMAND_EXECUTION]: The skill executes
npx react-doctor@latestto perform automated scans of the React codebase. This command is used to generate structured evidence for the audit and is a core part of the skill's intended functionality. - [EXTERNAL_DOWNLOADS]: Remediation instructions are fetched from
https://www.react.doctor/prompts/rules/at runtime. These downloads are used to populate implementation plans with verified fix recipes rather than relying on the model's memory. - [SAFE]: The skill includes an explicit security rule (Hard Rule 4) requiring the agent to treat repository content as data rather than instructions. This provides protection against indirect prompt injection attacks where a malicious file in the codebase might attempt to hijack the agent's behavior.
- [SAFE]: Although the skill generates plans for code modification, it strictly enforces a read-only policy on the existing source code, directing any actual implementation tasks to isolated plans or separate execution workflows.
Audit Metadata