add-pdf-report
Pass
Audited by Gen Agent Trust Hub on Oct 10, 2026
Risk Level: SAFE
Full Analysis
- Dependency Verification: The skill utilizes a static Node.js script via the Bash tool to inspect
package.json. It identifies required packages likeexpo-printand optional ones likeexpo-sharing. Crucially, it is programmed to stop execution if dependencies are missing rather than attempting to install them automatically, preserving the integrity of the environment. - Local Resource Access: The skill interacts with standard project configuration files such as
app.config.js,power.config.json, andpackage.json. These checks are performed to ensure the tool is operating within a correctly initialized mobile application project. - Safe Code Generation: The skill generates a TypeScript wrapper (
src/native/pdfReport.ts) that includes internal sanitization logic. Specifically, it provides anescapePdfHtmlfunction to mitigate risks associated with dynamic HTML content being rendered into a PDF. - Development Workflow Integration: It uses
npx --no-install tsc --noEmitfor type-checking. By using the--no-installflag, the skill ensures it only uses existing local binaries, preventing the unintentional download and execution of remote packages during the validation phase.
Audit Metadata