component-api-validator
Pass
Audited by Gen Agent Trust Hub on Sep 24, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: Fetches previous versions of component libraries using
npm packfrom the official npm registry for breaking change comparison. - [REMOTE_CODE_EXECUTION]: Utilizes
npxto execute component documentation and metadata extraction tools includingreact-docgen-typescript,custom-elements-manifest, andvue-component-metaas part of the API extraction process. - [INDIRECT_PROMPT_INJECTION]: The skill analyzes external source code and metadata which represents a surface for indirect prompt injection.
- Ingestion points: Component source files (React, Vue, Web Components),
package.json,tsconfig.json, Storybook metadata, and Figma property definitions. - Boundary markers: The skill does not define specific delimiters or instructions to ignore embedded prompts in the analyzed data.
- Capability inventory: Shell access via
Bash, file writing viaWrite, and execution of utility packages vianpx. - Sanitization: No explicit sanitization or validation of the ingested code or metadata content is mentioned.
Audit Metadata