skills/weng-lab/skills/react-doctor/Gen Agent Trust Hub

react-doctor

Pass

Audited by Gen Agent Trust Hub on Jul 28, 2026

Risk Level: SAFECOMMAND_EXECUTIONDATA_EXFILTRATIONPROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
  • [COMMAND_EXECUTION]: The skill executes the react-doctor tool via pnpm exec to perform repository scans, explain diagnostic rules, and modify project configuration files (e.g., doctor.config.ts).- [DATA_EXFILTRATION]: The react-doctor utility includes built-in telemetry, crash reporting, and a remote scoring service that sends data to react.doctor by default. The skill documents the usage of the --no-score flag to opt-out of these network activities.- [PROMPT_INJECTION]: The skill facilitates an indirect prompt injection surface by processing outputs from the react-doctor CLI and findings from the user's React source code. Ingestion points include CLI command output and diagnostic findings from code files. No explicit boundary markers or sanitization logic are defined in the instructions to separate untrusted data from the agent's context. The skill maintains shell command execution capabilities via pnpm exec.- [EXTERNAL_DOWNLOADS]: The skill references external rule documentation and recipes hosted at https://www.react.doctor and assumes the availability of the react-doctor package.
Audit Metadata
Risk Level
SAFE
Analyzed
Jul 28, 2026, 02:32 PM
Security Audit — agent-trust-hub — react-doctor