iota
Pass
Audited by Gen Agent Trust Hub on Nov 9, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTIONCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill fetches design themes and UI components from the official domain
design.useiota.spaceand a recommended third-party loader registrydotmatrix.zzzzshawn.cloud. - [REMOTE_CODE_EXECUTION]: It employs
npx shadcn addto download and integrate remote UI components into the project environment, which is the standard mechanism for this design system. - [COMMAND_EXECUTION]: The instructions direct the agent to perform setup and verification tasks using shell commands, including
npx shadcnfor resource addition andnpx eslintfor linting. - [INDIRECT_PROMPT_INJECTION]: The skill establishes extensive instructions for UI generation within
SKILL.md. It includes mandatory safety guidelines (e.g., in Step 4 and Global Rule 9) that prevent the agent from generating fake credentials or environment keys, requiring user permission for sensitive actions and providing clear boundary markers for acceptable AI behavior. The agent maintains a capability inventory including shell execution vianpx.
Audit Metadata