react-doctor
Pass
Audited by Gen Agent Trust Hub on Sep 15, 2026
Risk Level: SAFEREMOTE_CODE_EXECUTIONCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [REMOTE_CODE_EXECUTION]: The skill instructs the execution of
npx -y react-doctor@latest, which downloads and runs a package from the npm registry at runtime. - [COMMAND_EXECUTION]: The skill executes the
react-doctorCLI tool on the local directory to perform code diagnostics. - [INDIRECT_PROMPT_INJECTION]: The skill processes data from a local codebase which is an untrusted ingestion surface.
- Ingestion points: Reads files from the current project directory using the
react-doctortool. - Boundary markers: None identified; instructions do not include specific delimiters for tool output.
- Capability inventory: The skill uses
npxto execute commands. - Sanitization: No evidence of input sanitization or output filtering before processing diagnostics.
Audit Metadata