react-hook-form
Pass
Audited by Gen Agent Trust Hub on Jul 17, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSPROMPT_INJECTION
Full Analysis
- [SAFE]: The skill instructions prioritize secure implementation patterns, such as using validation resolvers and maintaining a clear separation between client-side input and server-side authoritative state.
- [EXTERNAL_DOWNLOADS]: The skill references documentation and community resources from well-known and trusted providers in the React ecosystem, including react-hook-form.com for official APIs, ui.shadcn.com for UI patterns, and tkdodo.eu for state management best practices.
- [PROMPT_INJECTION]: The skill addresses the processing of external data (e.g., API payloads), which constitutes an indirect prompt injection surface. It mitigates this risk through the following evidence chain:
- Ingestion points: Server-fetched data used to initialize form defaults in
references/server-data-and-lifecycle.md. - Boundary markers: The process requires explicit boundary transformations and mapping to valid default values.
- Capability inventory: The skill is restricted to frontend React code generation and does not involve subprocess execution, file system modifications, or sensitive network calls.
- Sanitization: The guidelines mandate schema-based validation (e.g., Zod or Yup) and specify that server-side validation must remain the authoritative source for security decisions.
Audit Metadata