trunative-react-native
Pass
Audited by Gen Agent Trust Hub on Sep 17, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and process user-provided configuration files such as PRODUCT.md, DESIGN.md, and STACK.md. These files enter the agent's context and influence its UI generation and review behavior, representing a potential surface for indirect injection if the processed data contains adversarial instructions.
- [COMMAND_EXECUTION]: The skill instructs the agent to execute several CLI tools for project verification and rendering, including 'npx trunative doctor', 'npx trunative rubric', 'chrome --headless' (for wireframe capture), and mobile development tools like 'adb' and 'xcrun'. These are standard development operations within the skill's stated purpose.
- [EXTERNAL_DOWNLOADS]: The skill references several well-known and trusted external resources for lookup material, including official documentation from Apple (developer.apple.com), Google (fonts.google.com), and established package registries (npmjs.com via npx). These references are used for standard font and tool retrieval.
Audit Metadata