json-render-react
Pass
Audited by Gen Agent Trust Hub on Mar 10, 2026
Risk Level: SAFEPROMPT_INJECTION
Full Analysis
- [PROMPT_INJECTION]: The skill ingests JSON specifications from potentially untrusted sources like AI models or external API endpoints, presenting a surface for indirect prompt injection.\n
- Ingestion points: The
specprop in theRenderercomponent and the data retrieved through theuseUIStreamhook.\n - Boundary markers: The skill documentation does not demonstrate the use of boundary markers or instructions to ignore instructions within the ingested JSON content.\n
- Capability inventory: The system can update internal state via actions like
setState, dispatch event-driven actions, and execute registered$computedfunctions.\n - Sanitization: The skill employs
zodschemas to validate component props, ensuring that the ingested data conforms to expected structures and types.
Audit Metadata