21st-design-sync
Pass
Audited by Gen Agent Trust Hub on Jul 11, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill integrates with a known service (21st.dev) using its official CLI tool (
@21st-dev/cli). - [COMMAND_EXECUTION]: The skill uses
npx @21st-dev/cliand21st publish-themeto perform its primary function. These commands are scoped to the intended purpose of design synchronization. - [CREDENTIALS_UNSAFE]: The instructions correctly advise users on secure credential management, recommending the use of environment variables (
TWENTYFIRST_TOKENorAPI_KEY_21ST) or specific command-line flags. It explicitly instructs the agent not to try to "mint" or generate keys itself, relying on the user to provide a valid API key from the official dashboard. - [DATA_EXFILTRATION]: While the skill reads project CSS files and sends them to an external service (21st.dev), it includes a mandatory human-in-the-loop confirmation step before publishing, as themes are public by default. The destination is the vendor's official infrastructure (21st.dev).
Audit Metadata