currency-input
Pass
Audited by Gen Agent Trust Hub on Sep 18, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill provides documentation and code examples for implementing a frontend currency input component. It does not execute unauthorized commands, exfiltrate data, or contain any malicious patterns.
- [DATA_EXPOSURE]: The skill includes a 'Tracking' section that describes an analytics event payload for monitoring user interaction. This is standard practice for UX research and does not involve exfiltrating sensitive system data or credentials.
- [EXTERNAL_DOWNLOADS]: The skill mentions several reputable NPM packages (react-number-format, dinero.js, react-imask) as resources for implementation. These are well-known libraries in the frontend development ecosystem and are cited as recommendations for developers, not as remote code executed by the agent itself.
- [INDIRECT_PROMPT_INJECTION]: As a UI pattern for a form input, the resulting component is designed to ingest user data. The skill correctly identifies this attack surface and provides best practices for sanitization, such as stripping non-numeric characters (
.replace(/[^0-9.-]/g, '')) and performing server-side validation to prevent data manipulation.
Audit Metadata