init-react-frontend
Pass
Audited by Gen Agent Trust Hub on Mar 12, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill executes
npm viewcommands to query the public npm registry for the latest stable versions of all project dependencies. It also runsnpm installto initialize the project environment and may optionally run build and test scripts.- [EXTERNAL_DOWNLOADS]: The skill downloads project dependencies from the npm registry and usesnpxto install an additional skill from the vendor's repository (Hillstone-Networks/Agent-Skills). These actions are consistent with the skill's stated purpose and originate from the author's own infrastructure.- [PROMPT_INJECTION]: The skill creates anAGENTS.mdfile containing instructional templates that define workflows for AI agents. While these serve as persistent instructions for future agent sessions, they are a documented architectural feature for project coordination rather than a safety bypass.
Audit Metadata