rule-validate

Warn

Audited by Gen Agent Trust Hub on Oct 5, 2026

Risk Level: MEDIUMEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTIONCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The skill fetches the @rayhanadev/truffler package from the npm registry using bunx.
  • [REMOTE_CODE_EXECUTION]: The package @rayhanadev/truffler is executed via bunx to inspect code helpers.
  • [COMMAND_EXECUTION]: The skill runs local diagnostic and workflow tools including rde-eval, run-parity, and nr changeset.
  • [INDIRECT_PROMPT_INJECTION]: The skill processes implementation code for React Doctor rules, which can contain instructions from untrusted sources.
  • Ingestion points: Implementation files and code context provided during rule validation.
  • Boundary markers: None specified for distinguishing rule logic from agent instructions.
  • Capability inventory: Shell command execution and remote package running capabilities.
  • Sanitization: No explicit sanitization or filtering of rule code content is mentioned.
Audit Metadata
Risk Level
MEDIUM
Analyzed
Oct 5, 2026, 09:31 AM