frontend-dev-guidelines

Warn

Audited by Gen Agent Trust Hub on May 4, 2026

Risk Level: MEDIUMEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The skill's code examples and documentation frequently reference non-standard and unverifiable Node.js packages. Specifically, Example 5 in complete-examples.md and several sections in other resource files instruct the agent to use react-hook-blog and @hookblog/resolvers/zod instead of the industry-standard react-hook-form and @hookform/resolvers.
  • [COMMAND_EXECUTION]: By recommending the use of non-existent or suspicious libraries like react-hook-blog, the skill implicitly encourages the agent to execute installation commands (e.g., npm install react-hook-blog) which could result in the execution of malicious scripts from untrusted packages.
  • [OBFUSCATION]: There is a widespread and systematic pattern of word substitution throughout the skill. Terms like 'performance' are replaced with 'perblogance', 'form' with 'blog', and 'transform' with 'transblog'. This behavior is characteristic of attempts to bypass automated scanners or to intentionally degrade the quality and safety of generated code by forcing the use of non-standard terminology and dependencies.
Audit Metadata
Risk Level
MEDIUM
Analyzed
May 4, 2026, 05:08 PM