rule-validate
Warn
Audited by Gen Agent Trust Hub on Oct 5, 2026
Risk Level: MEDIUMEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTIONCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill fetches the
@rayhanadev/trufflerpackage from the npm registry usingbunx. - [REMOTE_CODE_EXECUTION]: The package
@rayhanadev/truffleris executed viabunxto inspect code helpers. - [COMMAND_EXECUTION]: The skill runs local diagnostic and workflow tools including
rde-eval,run-parity, andnr changeset. - [INDIRECT_PROMPT_INJECTION]: The skill processes implementation code for React Doctor rules, which can contain instructions from untrusted sources.
- Ingestion points: Implementation files and code context provided during rule validation.
- Boundary markers: None specified for distinguishing rule logic from agent instructions.
- Capability inventory: Shell command execution and remote package running capabilities.
- Sanitization: No explicit sanitization or filtering of rule code content is mentioned.
Audit Metadata