argent-react-native-profiler
Pass
Audited by Gen Agent Trust Hub on Nov 6, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill is designed to process and analyze runtime data from external mobile applications, creating a surface for potential indirect prompt injection through untrusted application metadata.\n
- Ingestion points: Profiling data, including component names and JS function call stacks, is ingested via react-profiler-analyze and profiler-cpu-query in SKILL.md.\n
- Boundary markers: The instructions do not specify delimiters for isolating data provided by the profiling tools from agent instructions.\n
- Capability inventory: The skill has the capability to read project source code and modify it to apply performance fixes as described in the workflow section of SKILL.md.\n
- Sanitization: There is no mention of filtering or sanitizing application-provided metadata before analysis.\n- [SAFE]: The skill's functionality is strictly aligned with its stated purpose of performance profiling. All tools and procedures described (such as CPU sampling and React commit analysis) are standard diagnostic practices within the software-mansion ecosystem and do not involve suspicious network activity or obfuscated code.
Audit Metadata