theme-elements

Pass

Audited by Gen Agent Trust Hub on Oct 12, 2026

Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The skill uses the npx shadcn@latest add command to fetch UI components from the @elements registry. This involves downloading external source code and templates into the local project.
  • [COMMAND_EXECUTION]: The skill instructs the agent to execute shell commands (npx, shadcn) to automate the installation of dependencies and UI elements.
  • [INDIRECT_PROMPT_INJECTION]: The skill uses a variant placeholder {variant} in its installation commands. While the skill lists specific valid variants (e.g., button, classic, dropdown), the agent should ensure that user-provided input for this placeholder is validated before being passed to a shell execution environment to prevent command injection.
Audit Metadata
Risk Level
SAFE
Analyzed
Oct 12, 2026, 07:36 AM