engineering-workflows
Pass
Audited by Gen Agent Trust Hub on Oct 31, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill fetches a triage playbook and per-rule auditing prompts from the react.doctor domain. These resources provide the logic for scanning and fixing React-specific codebase issues.
- [REMOTE_CODE_EXECUTION]: The audit workflow instructs the agent to fetch a remote markdown playbook (
react-doctor-agent.md) and follow the steps defined within it. This mechanism allows the tool to update its auditing logic without requiring a skill reinstall. - [INDIRECT_PROMPT_INJECTION]: The skill handles instructions from an external source that influence the agent's behavior. To mitigate risks, the instructions explicitly advise the agent to treat the fetched content as untrusted input and to restrict its operations to local file modifications, avoiding commands like commits, pushes, or data exfiltration.
Audit Metadata