web-forms-react-hook-form
Pass
Audited by Gen Agent Trust Hub on Sep 15, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill describes forms that ingest user-provided data through native and controlled inputs, which constitutes a surface for indirect prompt injection. * Ingestion points: Native inputs, textareas, and custom components in all form examples (e.g., SKILL.md, core.md, arrays.md). * Boundary markers: Explicit instructions to use validation schemas (Zod) and register rules to constrain input values. * Capability inventory: Form methods pass aggregated data to submission callbacks like loginUser, updateUser, and createInvoice. * Sanitization: The skill relies on standard React Hook Form validation logic and React's default output escaping mechanisms.
- [SAFE]: The metadata file references a schema from the vendor's official GitHub repository (agents-inc/cli). This is a verified vendor-owned resource used for configuration validation.
Audit Metadata