frontend-data-fetching-cache-contracts
Pass
Audited by Gen Agent Trust Hub on Sep 17, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill references official technical documentation and best practices from well-known services and trusted organizations, including TanStack, Vercel (SWR), Redux Toolkit, Apollo GraphQL, and Mozilla (MDN). These references are used solely for instructional purposes.
- [COMMAND_EXECUTION]: The skill suggests using the
rg(ripgrep) command-line tool to identify relevant query and mutation patterns within the project's source code (e.g.,src/andapp/directories). These are standard search operations for a code-auditing agent and do not involve executing untrusted scripts. - [INDIRECT_PROMPT_INJECTION]: The skill is designed to analyze source code, which constitutes a surface for indirect prompt injection if malicious instructions are embedded in the code being audited (e.g., within comments). This is an inherent risk of the skill's primary function as an auditor.
- Ingestion points: The agent reads local source files in
src/andapp/directories. - Boundary markers: Absent; the skill relies on the agent's ability to distinguish code from instructions.
- Capability inventory: The skill uses search tools (
rg) and performs content analysis; it does not write to the filesystem or perform network exfiltration. - Sanitization: None specified for the read-only analysis process.
Audit Metadata