21st-cli-use
Pass
Audited by Gen Agent Trust Hub on Jul 11, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [COMMAND_EXECUTION]: The skill instructs the agent to use the
@21st-dev/cliutility for tasks such as searching the catalog (21st search), retrieving component code (21st get), and installing items into the project (21st add). - [EXTERNAL_DOWNLOADS]: The CLI fetches UI components, CSS themes, and SVG logos from the vendor's repository and the
svgl.applibrary. - [DATA_EXPOSURE]: The skill documents standard authentication procedures, noting that login tokens are stored locally at
~/.config/21st/auth.jsonand can be provided via environment variables (TWENTYFIRST_TOKENorAPI_KEY_21ST). - [INDIRECT_PROMPT_INJECTION]: The skill processes external data from the 21st.dev registry (search results and component code) which is then used to write files or install dependencies.
- Ingestion points: Data retrieved via
21st search,21st get, and21st addcommands. - Boundary markers: None explicitly defined in the instructions.
- Capability inventory: The tool can write to the filesystem (
components/ui/) and install Node.js packages via the project's package manager. - Sanitization: Standard CLI and package manager validation is assumed for the vendor's registry.
Audit Metadata