react-native-best-practices
Pass
Audited by Gen Agent Trust Hub on Sep 14, 2026
Risk Level: SAFECOMMAND_EXECUTIONDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill provides numerous shell commands for bundling, profiling, and environment configuration (e.g.,
npx react-native bundle,./gradlew analyzeReleaseBundle,xcodebuild). It includes explicit security notes inSKILL.mdadvising users to review these operations before running and to avoid piping remote scripts directly to a shell. - [DYNAMIC_EXECUTION]: The
references/bundle-code-splitting.mddocumentation describes patterns for implementing remote JavaScript chunk loading. Although this facilitates dynamic code execution, the skill provides high-quality security guardrails, including serving chunks from first-party HTTPS-only origins, using signed release manifests, and enabling strict code signing verification. - [INDIRECT_PROMPT_INJECTION]: The skill involves the analysis of external data sources such as bundle maps, performance markers, and profiler logs. Processing these artifacts creates a surface for indirect prompt injection, although the data typically originates from trusted local development tools.
- Ingestion points: Analysis of JavaScript source maps (
references/bundle-analyze-js.md) and React render profiles (references/js-profile-react.md). - Boundary markers: The guidelines recommend manual verification and re-measurement of metrics to validate automated findings.
- Capability inventory: The skill uses system shell commands for build automation, file system listing, and performance profiling.
- Sanitization: The skill provides architectural advice and implementation patterns, deferring sanitization logic to the suggested security configurations (e.g., strict signature verification).
Audit Metadata