async-effect-race-contracts
Pass
Audited by Gen Agent Trust Hub on Oct 15, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill provides technical guidelines and regex-based search patterns for auditing React source code. All commands provided (
rg) are intended for local filesystem searches during code review. - [SAFE]: All external documentation links point to official and trusted domains, including React's official documentation (react.dev), Mozilla Developer Network (developer.mozilla.org), and Meta/Facebook's GitHub repository (github.com/facebook/react). These are recognized as well-known and trusted technology services.
- [INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and analyze untrusted project source code, which constitutes a potential attack surface for indirect prompt injection.
- Ingestion points: Project source code files (referenced as
src/andapp/in search commands). - Boundary markers: None explicitly defined in the instructions.
- Capability inventory: The skill uses
rg(ripgrep) to search local directories. It does not perform network operations or arbitrary script execution. - Sanitization: None specified for the input source code.
- Note: This is an inherent risk factor for any code-auditing tool and does not indicate malicious intent in the skill itself.
Audit Metadata