react-data-provider
Pass
Audited by Gen Agent Trust Hub on Mar 30, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill implements secure authentication patterns by recommending that access tokens be stored in module-scoped memory variables rather than persistent browser storage (localStorage/sessionStorage), which mitigates XSS-based token theft.
- [SAFE]: The provided API client implementation uses standard security practices, including httpOnly cookies for refresh tokens and automated token refresh logic with request queuing.
- [SAFE]: The documentation includes explicit security guidelines for environment variable management, warning developers not to prefix sensitive secrets (like database URLs or JWT secrets) with 'VITE_' to prevent them from being bundled into the client-side code.
- [SAFE]: The skill mandates sensitive information masking in logging (e.g., passwords, emails, and PII) and prohibits logging entire request/reponse bodies, which prevents accidental data exposure in monitoring systems.
- [SAFE]: No obfuscation, suspicious network calls, or unauthorized file system operations were detected. The skill utilizes well-known, industry-standard libraries for its proposed tech stack.
Audit Metadata