react-native-reusables
Pass
Audited by Gen Agent Trust Hub on Jun 13, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [COMMAND_EXECUTION]: The documentation references numerous shell commands for using the
react-native-reusablesCLI to initialize projects (init), scaffold components (add), and perform diagnostic checks (doctor). These are standard development workflows for this library. - [EXTERNAL_DOWNLOADS]: The skill describes using the CLI to fetch component definitions and dependencies from the official registry at
reactnativereusables.comor from custom third-party URLs provided by the user. This is a core feature for extensibility and project management. - [INDIRECT_PROMPT_INJECTION]: The skill documents a capability that could be an attack surface if an agent is instructed to fetch components from an untrusted source.
- Ingestion points: The
npx react-native-reusables add <url>command described infeatures-registry-cli.mdallows the agent to download content from arbitrary remote URLs. - Boundary markers: The documentation does not specify the use of delimiters or 'ignore embedded instructions' warnings for content fetched via the CLI.
- Capability inventory: The CLI tool writes files to the local filesystem (
SKILL.md,core-installation.md) and executes package installation commands (npx expo install). - Sanitization: Sanitization is not explicitly discussed in the skill documentation; the safety of fetched content depends on the registry source and the CLI's internal validation logic.
- [SAFE]: No obfuscated code, hidden instructions, credential theft, or unauthorized persistence mechanisms were found. All referenced resources and packages are standard within the React Native and Expo ecosystems.
Audit Metadata