21st-cli-use
Pass
Audited by Gen Agent Trust Hub on Sep 9, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill uses the
@21st-dev/clipackage from the npm registry vianpx. This is the official command-line interface provided by the skill author for accessing their service. - [COMMAND_EXECUTION]: The skill facilitates command execution through the
21stCLI for tasks such as installing components (21st add), initializing configurations (21st init), and managing authentication. These commands perform file system writes and package installations, which are standard for development tools. - [INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data from the external 21st.dev registry and processes user-supplied search queries.
- Ingestion points: Search results from
21st search, component code from21st get, and AI-generated prompts in21st generate(SKILL.md). - Boundary markers: No specific delimiters or "ignore" instructions are present to separate external content from system instructions.
- Capability inventory: The skill can write to the filesystem, install npm dependencies, and perform network requests (SKILL.md).
- Sanitization: The instructions do not specify any validation or sanitization for the external data being processed.
Audit Metadata