chakra-ui-builder
Pass
Audited by Gen Agent Trust Hub on Apr 29, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill provides instructions for running standard terminal commands using package managers (npm, pnpm, yarn, bun) and the official Chakra UI CLI (npx). These commands are used for library installation, project configuration, and component generation.- [EXTERNAL_DOWNLOADS]: The skill facilitates the download and installation of official Chakra UI packages and established peer dependencies (such as next-themes and recharts) from the public npm registry.- [PROMPT_INJECTION]: The skill is designed to ingest local project metadata (package.json, lockfiles) and source code to provide contextual UI generation. This functionality creates an indirect prompt injection surface.
- Ingestion points: Local project files including package.json, lockfiles (pnpm-lock.yaml, yarn.lock, bun.lock, package-lock.json), and existing application source code.
- Boundary markers: The instructions do not define specific boundary markers or delimiters for ingested data.
- Capability inventory: The skill has the capability to suggest and execute shell commands for package management and CLI operations (npm install, npx @chakra-ui/cli).
- Sanitization: No sanitization or validation of the content of the read files is performed before processing.
Audit Metadata