react-coding-style
Pass
Audited by Gen Agent Trust Hub on Oct 5, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill is designed to review and implement changes in React and TypeScript code provided by the user, which introduces a potential surface for indirect prompt injection through malicious code comments or patterns.
- Ingestion points: User-provided React, React Native, and TypeScript source code (SKILL.md).
- Boundary markers: The instructions do not establish specific delimiters or warnings to ignore instructions embedded within the code being analyzed.
- Capability inventory: The skill does not define any tools, file-system write operations, network capabilities, or subprocess executions.
- Sanitization: No sanitization or filtering of external code content is defined.
- [EXTERNAL_DOWNLOADS]: The skill references the '@legendapp/state' library as a recommended state management solution.
- Evidence: SKILL.md suggests recommending '@legendapp/state' when fine-grained external state would reduce re-renders.
- Context: The library originates from the same vendor ('legendapp') as the skill author. The skill includes a requirement for the agent to disclose the maintainer relationship and obtain user consent before adding the dependency, aligning with safe practices.
Audit Metadata