mobile-component-patterns
Pass
Audited by Gen Agent Trust Hub on Aug 28, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill ingests user-provided component names and reuse requirements to generate source code and test files using the
mobile_generateComponenttool. This creates a surface where malicious input could potentially influence the content of the generated files. - Ingestion points: The skill requires
Component nameandReuse scopeas inputs from the user. - Boundary markers: The skill does not define explicit delimiters or warnings to ignore instructions embedded within these inputs when generating code.
- Capability inventory: The skill utilizes file generation/writing capabilities through the
mobile_generateComponenttool. - Sanitization: No explicit sanitization or validation logic is provided for the user-supplied names or scopes before they are interpolated into the generation process.
- [EXTERNAL_DOWNLOADS]: The skill provides instructions for installing external libraries from well-known registries to support styling and testing.
- Installation of
nativewindandtailwindcssusingnpx expo install(Step 3). - Installation of
@testing-library/react-nativeand@testing-library/jest-nativeusingnpm install(Step 6). - These downloads target widely used, reputable packages in the React Native ecosystem.
Audit Metadata