flpbalada-react-key-prop
Fail
Audited by Gen Agent Trust Hub on Sep 14, 2026
Risk Level: HIGHEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill documentation points users to a repository for the 'nanoid' utility at 'https://github.com/ai-cookie/nanoid'. This is not the official repository for the library (which is 'https://github.com/ai/nanoid'). The use of a visually similar but different account name ('ai-cookie' vs 'ai') is a typical typosquatting technique used to distribute modified or malicious versions of popular packages.
- [REMOTE_CODE_EXECUTION]: By instructing the user or agent to use a library from an untrusted source, the skill facilitates the execution of unverified third-party code within the application environment.
Recommendations
- AI detected serious security threats
Audit Metadata