frontend-dev-guidelines
Warn
Audited by Gen Agent Trust Hub on May 4, 2026
Risk Level: MEDIUMEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill's code examples and documentation frequently reference non-standard and unverifiable Node.js packages. Specifically, Example 5 in
complete-examples.mdand several sections in other resource files instruct the agent to usereact-hook-blogand@hookblog/resolvers/zodinstead of the industry-standardreact-hook-formand@hookform/resolvers. - [COMMAND_EXECUTION]: By recommending the use of non-existent or suspicious libraries like
react-hook-blog, the skill implicitly encourages the agent to execute installation commands (e.g.,npm install react-hook-blog) which could result in the execution of malicious scripts from untrusted packages. - [OBFUSCATION]: There is a widespread and systematic pattern of word substitution throughout the skill. Terms like 'performance' are replaced with 'perblogance', 'form' with 'blog', and 'transform' with 'transblog'. This behavior is characteristic of attempts to bypass automated scanners or to intentionally degrade the quality and safety of generated code by forcing the use of non-standard terminology and dependencies.
Audit Metadata