react-native-best-practices
Pass
Audited by Gen Agent Trust Hub on Sep 16, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTIONDYNAMIC_EXECUTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: Fetches Metro bundler patches from the Software Mansion GitHub organization (
raw.githubusercontent.com/software-mansion/...) and references AI model downloads from HuggingFace. These are recognized as vendor-owned or trusted repositories and are used for legitimate configuration tasks. - [COMMAND_EXECUTION]: Instructs the use of local shell commands for development workflows, including environment scanning (
find,grep), version detection (node -e), and package management (npm,yarn,npx). These operations are necessary for the skill's stated purpose of configuring the React Native development environment. - [INDIRECT_PROMPT_INJECTION]: Provides implementation patterns for rich text components (
react-native-enriched-html,react-native-enriched-markdown) that process user-controlled data. The skill explicitly identifies this as a security surface, warning that its normalizer is not a security sanitizer and providing guidance on using libraries like DOMPurify. - [DYNAMIC_EXECUTION]: Documents the use of
evaluateJavaScriptwithin C++ native modules using the JavaScript Interface (JSI). This is a standard architectural feature of React Native, and the skill provides appropriate performance and safety advice for its application.
Audit Metadata