react-doctor
Pass
Audited by Gen Agent Trust Hub on Mar 18, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill uses
npx -y react-doctor@latestto fetch and run the diagnostic package from the NPM registry. This is a standard method for executing utility tools in a development environment. - [COMMAND_EXECUTION]: The skill executes CLI commands to perform local codebase scanning. This is required for the tool's functionality and is implemented using standard flags that do not acquire elevated permissions.
- [PROMPT_INJECTION]: There is an indirect prompt injection surface as the tool scans user-controlled source code. Instructions hidden in code comments or strings could be echoed in the scan results and potentially influence the agent's behavior.
- Ingestion points: Local source code files scanned via the
react-doctorcommand inSKILL.md. - Boundary markers: None specified to separate tool results from agent instructions.
- Capability inventory: Shell command execution via
npxfor analysis tasks. - Sanitization: No explicit output sanitization or instruction filtering is documented in the skill.
Audit Metadata