react-native-reusables

Pass

Audited by Gen Agent Trust Hub on Jun 13, 2026

Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
  • [COMMAND_EXECUTION]: The documentation references numerous shell commands for using the react-native-reusables CLI to initialize projects (init), scaffold components (add), and perform diagnostic checks (doctor). These are standard development workflows for this library.
  • [EXTERNAL_DOWNLOADS]: The skill describes using the CLI to fetch component definitions and dependencies from the official registry at reactnativereusables.com or from custom third-party URLs provided by the user. This is a core feature for extensibility and project management.
  • [INDIRECT_PROMPT_INJECTION]: The skill documents a capability that could be an attack surface if an agent is instructed to fetch components from an untrusted source.
  • Ingestion points: The npx react-native-reusables add <url> command described in features-registry-cli.md allows the agent to download content from arbitrary remote URLs.
  • Boundary markers: The documentation does not specify the use of delimiters or 'ignore embedded instructions' warnings for content fetched via the CLI.
  • Capability inventory: The CLI tool writes files to the local filesystem (SKILL.md, core-installation.md) and executes package installation commands (npx expo install).
  • Sanitization: Sanitization is not explicitly discussed in the skill documentation; the safety of fetched content depends on the registry source and the CLI's internal validation logic.
  • [SAFE]: No obfuscated code, hidden instructions, credential theft, or unauthorized persistence mechanisms were found. All referenced resources and packages are standard within the React Native and Expo ecosystems.
Audit Metadata
Risk Level
SAFE
Analyzed
Jun 13, 2026, 06:10 PM