React Composition

PassAudited by ClawScan on May 1, 2026.

Overview

This is an instruction-only React architecture guidance skill with no runtime permissions; users should only note that its README includes unpinned install examples.

This skill appears safe as an instruction-only React composition guide. Before installing, prefer a trusted or pinned source rather than a moving GitHub branch or latest installer command.

Findings (1)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

Note

ASI04: Agentic Supply Chain Vulnerabilities

What this means

If a user installs from the moving GitHub branch, they may not get exactly the same artifact that was reviewed here.

Why it was flagged

The README provides a user-directed install command that references a GitHub main-branch path rather than a pinned version or commit, so the fetched content could change over time.

Skill content

npx add https://github.com/wpank/ai/tree/main/skills/frontend/react-composition

Recommendation

Prefer the reviewed registry artifact or a pinned commit/version when installing, and verify the source before running install commands.