shadcnui-helper
Pass
Audited by Gen Agent Trust Hub on Sep 11, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [SAFE]: The skill uses official and well-known documentation sources from
ui.shadcn.com. All network activity is limited to fetching instructions from this official domain. - [INDIRECT_PROMPT_INJECTION]: The skill processes data from external URLs which creates an attack surface for indirect prompt injection.
- Ingestion points: Documentation is fetched via
webfetchfrom URLs indexed inhttps://ui.shadcn.com/llms.txt(SKILL.md). - Boundary markers: No explicit boundary markers or instructions to ignore embedded prompts are provided.
- Capability inventory: The agent is empowered to fetch web content (
webfetch) and execute shell commands for package management (npx). - Sanitization: No validation or sanitization of the fetched markdown content is described.
Audit Metadata