react-best-practices
Pass
Audited by Gen Agent Trust Hub on Oct 14, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill fetches React best practice standards and rules from the official somnio-software GitHub repository (raw.githubusercontent.com) when local copies are unavailable. These documents are used as reference data for the audit and do not contain executable code.\n- [COMMAND_EXECUTION]: Executes local shell commands using the
Bashtool to retrieve the project's repository name viagit remoteand to perform file system enumeration usingfindandwc. The results are used for report naming and architectural inventory.\n- [INDIRECT_PROMPT_INJECTION]: As an auditing tool, the skill reads and processes user-provided source code which could theoretically contain instructions designed to deceive the analyzer.\n - Ingestion points: Project files including
.tsx,.ts, and.test.tsxare read for analysis by the scanner and analyzer agents.\n - Boundary markers: None. Instructions do not specify delimiters to separate code from instructions.\n
- Capability inventory: The skill possesses
Writeaccess to the reports directory,Bashtool for local command execution, andAgenttool for sub-agent management.\n - Sanitization: No content sanitization is performed on the source code before it is processed by the analysis models.
Audit Metadata