react-native-conventions-index
Pass
Audited by Gen Agent Trust Hub on Oct 18, 2026
Risk Level: SAFECOMMAND_EXECUTIONDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill includes functionality to execute local commands for internal testing purposes.
- Evidence:
scripts/check-lib.mjsusesnode:child_process.spawnSyncto run Node.js scripts within its self-test runner. - [DYNAMIC_EXECUTION]: The skill utilizes dynamic loading techniques to manage utilities and optional dependencies.
- Evidence:
scripts/check-lib.mjsincludes animportPackagefunction that uses theimport()statement to load local Node.js modules from paths computed at runtime. - [INDIRECT_PROMPT_INJECTION]: The skill acts as an orchestration hub that ingests and processes metadata from the project repository.
- Ingestion points:
scripts/lib/index-model.mjsreads descriptions from other skills'SKILL.mdfrontmatter, and configuration frompackage.jsonandrn-skills.config.json. - Boundary markers: Data retrieved from repo files is rendered into tables in
SKILL.mdandreferences/without explicit delimiters or warnings for the agent to ignore embedded instructions. - Capability inventory: The skill can write to the file system (
writeFileSyncinscripts/build-index.mjs) and execute local Node.js scripts. - Sanitization: Minimal sanitization is applied to ingested strings beyond basic format validation.
Audit Metadata