react-dashboard
Pass
Audited by Gen Agent Trust Hub on Sep 18, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill instructions describe building a React component (
KPIDashboard) that accepts adataobject as a prop. This constitutes an indirect prompt injection surface as the agent will interpolate untrusted data from external sources into the UI components. However, this is the primary intended purpose of the dashboarding skill. \n - Ingestion points: The
dataprop in theKPIDashboardcomponent in SKILL.md. \n - Boundary markers: The instructions do not specify any delimiters or safety warnings for the data processed by the React component. \n
- Capability inventory: The skill utilizes the
mcp__tdx-studio__render_reacttool to execute and display React code. \n - Sanitization: The example code does not demonstrate sanitization or validation of the input data before rendering it in the dashboard.
Audit Metadata