Ask Sonner Skill 安全审计
作者说它能做什么（原文）
Guide to Sonner, the React toast library — install and wire up the Toaster, pick the right toast() call, promise and loading toasts, updating, dismissing and persisting toasts, styling, theming and icons, positioning and multiple toasters. Use when working with Sonner or troubleshooting it — toasts that don't appear, appear twice, lose their styles, ignore Tailwind classes, sit behind a modal, or
这次检查未发现明显风险
- 已检查文件
- 2
- 发现的风险
- 0
Skill 逻辑拆解
此 Skill 是 Sonner React 通知库的使用指南，指示在应用根部挂载一个 Toaster，并只从客户端代码调用 toast；提供的源码中没有安装脚本、命令执行或凭据处理步骤。
查看原文
Two pieces, and only two:1. **One `<Toaster />`, mounted once**, as close to the root as possible (in Next.js: `layout.tsx` — it works inside server components). Never render it per-page or conditionally; a second mounted Toaster duplicates every toast.2. **`toast()` called from client code** — event handlers, effects, callbacks. It's a plain function, no hook or provider needed, but it does nothing on the server: in a server action, return the result and call `toast()` in the client code that receives it.该指南记录了通知按钮回调、自定义 JSX、持久通知及关闭通知等应用内 UI 行为。这些能力可由采用该指南的应用代码定义，但文中没有指示将数据发送到外部服务或执行未经用户授权的账户操作。
查看原文
| Success / error / info / warning icon | `toast.success('…')`, `toast.error('…')`, etc. || Spinner while you manage state yourself | `toast.loading('…')`, then update it by id || Loading → success/error tied to a promise | `toast.promise(promise, { loading, success, error })` — success/error accept functions receiving the resolved value/error || Button that does something | `{ action: { label, onClick } }` — closes the toast unless `onClick` calls `event.preventDefault()`; `cancel` is the secondary variant || Custom JSX, default toast shell | `toast(<jsx />)` || Custom JSX, no styles at all | `toast.custom((t) => <jsx />)` — headless, `t` gives you the id to dismiss |**Persist** — `{ duration: Infinity }`. **Dismiss** — `toast.dismiss(id)`, or `toast.dismiss()` for all. **Read active toasts** — `useSonner()` in React, `toast.getActiveToasts()` outside it.**Links or components in the text** — pass a function for the title or description: `toast(() => <a href="…">View</a>)`.SKILL.md 引用同包内的 API.md 来查询精确属性；所提供引用存在，内容是 Toaster 与 toast 的参数和函数说明。
查看原文
A guide skill for [Sonner](https://sonner.emilkowal.ski), the toast library. When a task involves Sonner — wiring it up, rendering toasts, styling them, or fixing them — answer from this file first. Full prop tables for `<Toaster />` and `toast()` live in [API.md](API.md); read it when you need an exact prop name, type, or default.## `toast()` options`toast(message, options)` — message is a string, JSX, or a function returning JSX. Returns the toast's id.文件引用关系图
1 处引用文件与检查记录2 个文件
检查范围与遗漏
逐文件查看涉及的内容
下方列出本次涉及的原文范围；纳入检查不代表已查清所有问题。
SKILL.md已纳入全文API.md已纳入全文
这份报告只针对上方版本。我们看了拿到的代码和说明文件，没有实际运行 Skill，也没有检查它另外安装的软件包。因此，这不是“保证安全”的承诺；换了版本或使用环境，结果也可能不同。
API.md配套文件SKILL.md工作说明
代码和说明中提到的操作
连接外部网站
A guide skill for [Sonner](https://sonner.emilkowal.ski), the toast library. When a task involves Sonner — wiring it up, rendering toasts, styling them, or fixing them — answer from this file first. Full prop tables for `<Toaster />` and `toast()` live in [API.md](API.md); read it when you need an exact prop name, type, or default.- 读取了多少行
- 146
- 文件校验值（用于核对版本）
- 159762a73cf36e1f5745db57b7d8495bac20adc0d0a344b4419b855f96159999