zod-to-form-runtime
Pass
Audited by Gen Agent Trust Hub on Mar 17, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill involves installing several Node.js packages from the NPM registry, including @zod-to-form/core, @zod-to-form/react, and @zod-to-form/cli from the NPM registry (SKILL.md).
- [COMMAND_EXECUTION]: Instructions are provided for running the npx zodform generate command to perform static code generation for forms based on configuration files (references/shared-config.md).
- [PROMPT_INJECTION]: The skill presents a surface for indirect prompt injection via the processing of Zod schemas to generate UI forms. 1. Ingestion points: The schema property in the ZodForm component (SKILL.md, references/api-reference.md). 2. Boundary markers: None identified. 3. Capability inventory: Renders UI fields and executes onSubmit callbacks with validated data. 4. Sanitization: Uses Zod's built-in schema validation and parsing.
- [SAFE]: The skill uses legitimate React and Zod patterns for schema-driven form generation. It does not contain obfuscated code, hardcoded credentials, or unauthorized network operations. The dynamic loading functionality in the component configuration is a standard practice for modular UI development.
Audit Metadata