skills/21st-dev/skill/21st-cli-use/Gen Agent Trust Hub

21st-cli-use

Pass

Audited by Gen Agent Trust Hub on Jul 11, 2026

Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
  • [COMMAND_EXECUTION]: The skill instructs the agent to use the @21st-dev/cli utility for tasks such as searching the catalog (21st search), retrieving component code (21st get), and installing items into the project (21st add).
  • [EXTERNAL_DOWNLOADS]: The CLI fetches UI components, CSS themes, and SVG logos from the vendor's repository and the svgl.app library.
  • [DATA_EXPOSURE]: The skill documents standard authentication procedures, noting that login tokens are stored locally at ~/.config/21st/auth.json and can be provided via environment variables (TWENTYFIRST_TOKEN or API_KEY_21ST).
  • [INDIRECT_PROMPT_INJECTION]: The skill processes external data from the 21st.dev registry (search results and component code) which is then used to write files or install dependencies.
  • Ingestion points: Data retrieved via 21st search, 21st get, and 21st add commands.
  • Boundary markers: None explicitly defined in the instructions.
  • Capability inventory: The tool can write to the filesystem (components/ui/) and install Node.js packages via the project's package manager.
  • Sanitization: Standard CLI and package manager validation is assumed for the vendor's registry.
Audit Metadata
Risk Level
SAFE
Analyzed
Jul 11, 2026, 08:56 PM
Security Audit — agent-trust-hub — 21st-cli-use