mobile-navigation-react-navigation
Pass
Audited by Gen Agent Trust Hub on Nov 4, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill documents the processing of untrusted external data via deep linking configurations and navigation parameters.
- Ingestion points: Deep link URL parsing in the
Appcomponent (via thelinkingprop) and route parameter access in screen components (viaroute.params). - Boundary markers: Data is passed through structured React Navigation objects, which provides architectural separation from the instruction flow, though the skill does not explicitly warn about prompt injection in parameters.
- Capability inventory: The skill's code examples are restricted to UI navigation, state management, and local persistence (AsyncStorage), with no high-risk capabilities such as arbitrary command execution or network exfiltration of sensitive data detected.
- Sanitization: Examples demonstrate basic string parsing for URL parameters (e.g., removing '@' prefixes) but do not include dedicated security validation or sanitization logic for user-controlled input strings.
Audit Metadata