react-native-conventions-index

Pass

Audited by Gen Agent Trust Hub on Oct 18, 2026

Risk Level: SAFECOMMAND_EXECUTIONDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill includes functionality to execute local commands for internal testing purposes.
  • Evidence: scripts/check-lib.mjs uses node:child_process.spawnSync to run Node.js scripts within its self-test runner.
  • [DYNAMIC_EXECUTION]: The skill utilizes dynamic loading techniques to manage utilities and optional dependencies.
  • Evidence: scripts/check-lib.mjs includes an importPackage function that uses the import() statement to load local Node.js modules from paths computed at runtime.
  • [INDIRECT_PROMPT_INJECTION]: The skill acts as an orchestration hub that ingests and processes metadata from the project repository.
  • Ingestion points: scripts/lib/index-model.mjs reads descriptions from other skills' SKILL.md frontmatter, and configuration from package.json and rn-skills.config.json.
  • Boundary markers: Data retrieved from repo files is rendered into tables in SKILL.md and references/ without explicit delimiters or warnings for the agent to ignore embedded instructions.
  • Capability inventory: The skill can write to the file system (writeFileSync in scripts/build-index.mjs) and execute local Node.js scripts.
  • Sanitization: Minimal sanitization is applied to ingested strings beyond basic format validation.
Audit Metadata
Risk Level
SAFE
Analyzed
Oct 18, 2026, 11:22 AM