web-state-jotai
Pass
Audited by Gen Agent Trust Hub on Nov 4, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [SAFE]: The skill provides educational content and code snippets for using Jotai, an atomic state management library. The patterns described, such as defining atoms at the module level and using Suspense for async operations, are consistent with official documentation and community standards.
- [EXTERNAL_DOWNLOADS]: The skill recommends using the
jotai-familypackage for parameterized atoms, providing a link to its official GitHub repository. This is a standard recommendation within the ecosystem because the library's built-in utility for this purpose is deprecated. - [INDIRECT_PROMPT_INJECTION]: The skill demonstrates patterns for fetching data from API endpoints (e.g., in
examples/async.md). Ingestion points: external API responses are read into atoms; Boundary markers: React Suspense boundaries are used for UI flow but no specific security delimiters or 'ignore' instructions are provided; Capability inventory: the skill includes the ability to persist data tolocalStorageorsessionStorageviaatomWithStorage; Sanitization: the examples do not show explicit sanitization or validation of the fetched data before use. This represents a standard architectural pattern in web development rather than a specific malicious vulnerability.
Audit Metadata