theme-elements
Pass
Audited by Gen Agent Trust Hub on Oct 12, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill uses the
npx shadcn@latest addcommand to fetch UI components from the@elementsregistry. This involves downloading external source code and templates into the local project. - [COMMAND_EXECUTION]: The skill instructs the agent to execute shell commands (
npx,shadcn) to automate the installation of dependencies and UI elements. - [INDIRECT_PROMPT_INJECTION]: The skill uses a variant placeholder
{variant}in its installation commands. While the skill lists specific valid variants (e.g.,button,classic,dropdown), the agent should ensure that user-provided input for this placeholder is validated before being passed to a shell execution environment to prevent command injection.
Audit Metadata