Skip to content
skillsafebeta
← Report library
Purpose / Other

Ask Sonner Skill Security Audit

What the author says it does (original text)

Guide to Sonner, the React toast library — install and wire up the Toaster, pick the right toast() call, promise and loading toasts, updating, dismissing and persisting toasts, styling, theming and icons, positioning and multiple toasters. Use when working with Sonner or troubleshooting it — toasts that don't appear, appear twice, lose their styles, ignore Tailwind classes, sit behind a modal, or

Independent security check

No obvious risks found in this check

Files checked
2
Risks found
0
Could it run dangerous commands?Looks for programs run straight after downloading, remote control of your computer, and hidden commands.No risks found
Could it expose your files or keys?Looks for uploads of files containing passwords or keys, and keys written directly in the code.No risks found
Could it delete files or keep running?Looks for broad file deletion, disk overwrites, and programs set to start automatically.No risks found
Could it bypass safety checks?Looks for skipped website security checks, excessive file access, or actions that skip your approval.No risks found
Could it mislead the AI or hide text?Checks the skill instructions for requests to ignore you, influence the report, or hide text in invisible characters.No risks found
Could it change links or payment recipients without asking?Looks for forced referral or payment changes combined with instructions to hide the change.No risks found

Inside this skill

5 instruction sections

This Skill is a usage guide for the Sonner React notification library. It directs users to mount one Toaster near the application root and call toast only from client code; the supplied source contains no installation script, command execution, or credential-handling steps.

View source
SKILL.md:12In the instructionsOpen original file
Two pieces, and only two:1. **One `<Toaster />`, mounted once**, as close to the root as possible (in Next.js: `layout.tsx` — it works inside server components). Never render it per-page or conditionally; a second mounted Toaster duplicates every toast.2. **`toast()` called from client code** — event handlers, effects, callbacks. It's a plain function, no hook or provider needed, but it does nothing on the server: in a server action, return the result and call `toast()` in the client code that receives it.

The guide documents in-app UI behavior such as button callbacks, custom JSX, persistent notifications, and dismissal. Application code using the guide can define these behaviors, but the text does not direct data to an external service or perform unauthorized account actions.

View source
SKILL.md:28In the instructionsOpen original file
| Success / error / info / warning icon | `toast.success('…')`, `toast.error('…')`, etc. || Spinner while you manage state yourself | `toast.loading('…')`, then update it by id || Loading → success/error tied to a promise | `toast.promise(promise, { loading, success, error })` — success/error accept functions receiving the resolved value/error || Button that does something | `{ action: { label, onClick } }` — closes the toast unless `onClick` calls `event.preventDefault()`; `cancel` is the secondary variant || Custom JSX, default toast shell | `toast(<jsx />)` || Custom JSX, no styles at all | `toast.custom((t) => <jsx />)` — headless, `t` gives you the id to dismiss |
SKILL.md:43In the instructionsOpen original file
**Persist** — `{ duration: Infinity }`. **Dismiss** — `toast.dismiss(id)`, or `toast.dismiss()` for all. **Read active toasts** — `useSonner()` in React, `toast.getActiveToasts()` outside it.**Links or components in the text** — pass a function for the title or description: `toast(() => <a href="…">View</a>)`.

SKILL.md refers to the bundled API.md for exact properties. The referenced file is present and contains parameter and function documentation for Toaster and toast.

View source
SKILL.md:8In the instructionsOpen original file
A guide skill for [Sonner](https://sonner.emilkowal.ski), the toast library. When a task involves Sonner — wiring it up, rendering toasts, styling them, or fixing them — answer from this file first. Full prop tables for `<Toaster />` and `toast()` live in [API.md](API.md); read it when you need an exact prop name, type, or default.
API.md:26In the instructionsOpen original file
## `toast()` options`toast(message, options)` — message is a string, JSX, or a function returning JSX. Returns the toast's id.
Start here · InstructionsSKILL.md
ask-sonner
Lines connect the instruction file to its sections, not an observed execution order. Select a section to read the source.

File reference map

References: 1
Files making referencesReferenced content
Lines show actual file references, not execution order. Select a node to highlight its connections and inspect the files and source locations. Dashed lines include files that still need locating.
Files and check records2 files

Coverage and gaps

Content covered in each file

These are the source ranges included in this check, not a guarantee that every issue has been resolved.

  • SKILL.mdFull text included
  • API.mdFull text included

This report is for the version above. We read the available code and instructions without running the skill or checking extra packages it installs. This is not a promise of safety: a different version or setup may behave differently.

  • API.mdSupporting file
  • SKILL.mdInstructions

Operations mentioned in code and instructions

Connect to websites
SKILL.md:8In the instructionsOpen original file
A guide skill for [Sonner](https://sonner.emilkowal.ski), the toast library. When a task involves Sonner — wiring it up, rendering toasts, styling them, or fixing them — answer from this file first. Full prop tables for `<Toaster />` and `toast()` live in [API.md](API.md); read it when you need an exact prop name, type, or default.
Lines read
146
File checksum (to compare versions)
159762a73cf36e1f5745db57b7d8495bac20adc0d0a344b4419b855f96159999