reactflow
Pass
Audited by Gen Agent Trust Hub on Jun 15, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSPROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill references downloading UI components from the official React Flow UI domain (
ui.reactflow.dev) using thenpx shadcntool. As these are official project resources, this is documented for awareness. - [PROMPT_INJECTION]: The skill exhibits an indirect prompt injection surface as it is designed to process untrusted user requirements to generate implementation code.
- Ingestion points: User requirements for React Flow graph implementations processed in
SKILL.md. - Boundary markers: None present.
- Capability inventory: Instructs the agent to generate React/TypeScript code and suggests shell commands (
npm install,npx shadcn). - Sanitization: None present.
Audit Metadata