kernel-dev-react-native
Pass
Audited by Gen Agent Trust Hub on Aug 28, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTIONINDIRECT_PROMPT_INJECTIONDYNAMIC_EXECUTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill recommends several external tools and services for performance monitoring and bundle analysis, such as Flashlight, Emerge Tools, and Bundlephobia. It also references numerous libraries from well-known organizations including Shopify, Spotify, Callstack, and Expo.
- [REMOTE_CODE_EXECUTION]: One reference file (
references/js-measure-fps.md) contains a command to install the Flashlight performance tool using a piped shell script (curl https://get.flashlight.dev | bash). While this is a powerful execution pattern, it targets a well-known developer tool in a relevant context. - [INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and review user-provided React Native code. This creates a surface for indirect prompt injection if the user code contains malicious instructions targeting the AI agent. However, the skill itself provides documentation and rules rather than executable automation that could be exploited.
- [DYNAMIC_EXECUTION]: The documentation for Re.Pack (
references/bundle-code-splitting.md) describes techniques for remote code loading and chunk evaluation at runtime. This is a standard optimization for large mobile applications but represents a dynamic execution surface.
Audit Metadata