react-server-components-framework
Pass
Audited by Gen Agent Trust Hub on Oct 12, 2026
Risk Level: SAFEDYNAMIC_CONTEXT_INJECTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [DYNAMIC_CONTEXT_INJECTION]: The file
scripts/create-server-component.mdutilizes the!command`` syntax to execute local shell commands such asgrep,find, anddate. These are used for project-specific environment detection (Next.js version, database client detection) and do not access sensitive files or perform network operations. - [EXTERNAL_DOWNLOADS]:
SKILL.mdreferences the use ofnpx -y next-devtools-mcp@latest. This is a standard method for invoking development tools from the official npm registry and is used here to provide debugging capabilities for AI agents. - [INDIRECT_PROMPT_INJECTION]: The scaffold script
scripts/create-server-component.mduses$ARGUMENTSas a placeholder for component names. While this allows user input to be interpolated into generated files, it is a standard design for templating skills and does not grant the agent elevated privileges. Evidence: Ingestion point inscripts/create-server-component.md($ARGUMENTS); Capability inventory includes file-write instructions; Sanitization is handled by the agent's typical code-generation safety boundaries.
Audit Metadata