run-react-doctor
Pass
Audited by Gen Agent Trust Hub on Jul 20, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [COMMAND_EXECUTION]: The skill instructs the agent on how to use several npm scripts (e.g.,
npm run doctor,npm run doctor:json) to execute the react-doctor tool for project auditing. - [EXTERNAL_DOWNLOADS]: The skill mentions dependencies on
react-doctorand theswrlibrary.swris a widely-used and well-known package from Vercel. - [INDIRECT_PROMPT_INJECTION]: The skill describes a workflow where the agent reads and interprets the content of a tool-generated report file (
./.react-doctor/report.json). This constitutes a potential data ingestion surface. - Ingestion points: The agent is instructed to read the JSON report generated by the tool in
SKILL.md. - Boundary markers: No specific delimiters or safety warnings for the report content are mentioned.
- Capability inventory: The skill has the capability to execute shell commands (
npm run) and read project files. - Sanitization: No explicit sanitization of the JSON report content is described.
Audit Metadata