react-hooks
Pass
Audited by Gen Agent Trust Hub on Oct 18, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The 'Instrumentation' section instructions the execution of a shell script at
./scripts/log-skill.sh. Because this file was not included in the skill package, its behavior—such as potential network or file system operations—cannot be verified. - [INDIRECT_PROMPT_INJECTION]: The skill is designed to analyze and modify React source code, which serves as an ingestion point for untrusted data.
- Ingestion points: React component files read during the 'Debugging Workflow'.
- Capability inventory: Local script execution via the instrumentation command.
- Boundary markers: Absent; no instructions are provided to the agent to disregard instructions embedded in code comments or strings.
- Sanitization: Absent; there is no mention of filtering or validating the code before processing.
Audit Metadata