react-hook-form
Pass
Audited by Gen Agent Trust Hub on Oct 8, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill instructions and reference materials focus entirely on standard frontend development practices. No evidence of prompt injection, data exfiltration, or obfuscation was found. External resources and links point to official documentation and well-known, trusted community resources.
- [INDIRECT_PROMPT_INJECTION]: The skill manages an attack surface where the agent processes data fetched from external APIs (e.g., for edit forms). The instructions mitigate this risk by mandating response shape validation and transformation at the data boundary before the data enters the form state. It also correctly notes that client-side processing does not replace authoritative server-side validation and authorization.
- [COMMAND_EXECUTION]: The skill recommends running standard development tools such as the project's TypeScript typecheck (
tsc) to verify changes. These are routine development activities and do not involve unsanitized user input or arbitrary command execution.
Audit Metadata