zustand-use
Pass
Audited by Gen Agent Trust Hub on Sep 15, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONDYNAMIC_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill triggers file system operations based on user-supplied strings (e.g., "count 스토어 생성") to automate store creation.
- Ingestion points: User-provided store names are extracted from natural language prompts as described in the "Store File Auto-generation" section.
- Boundary markers: The skill does not explicitly define delimiters to separate user-provided names from potential instructions, though it directs the agent to interpret the user's intent.
- Capability inventory: The skill utilizes the agent's ability to create directories (
src/store) and write files to the local file system. - Sanitization: The skill mandates "Name normalization" (camelCase conversion) for the provided names, which acts as a basic filter for the generated identifiers and filenames.
- [DYNAMIC_EXECUTION]: The skill generates boilerplate code for Zustand stores in both TypeScript and JavaScript using user-supplied names as variable and file identifiers.
- The generation follows fixed templates provided in the skill instructions.
- The logic includes environmental checks (looking for
tsconfig.json) to determine the appropriate language (TS vs JS).
Audit Metadata