creative-tim-ui
Pass
Audited by Gen Agent Trust Hub on Sep 21, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill facilitates the retrieval of UI component source code and configuration files from the official Creative Tim registry. This is a core feature enabling the agent to provide up-to-date blocks to the user.
- [COMMAND_EXECUTION]: Users are guided to utilize official CLI tools such as
@creative-tim/uiandshadcnto perform project setup and component installation tasks. These tools are standard for the described ecosystem. - [INDIRECT_PROMPT_INJECTION]: The skill establishes an ingestion point for external data by reading component definitions from a remote JSON registry. While this constitutes a data ingestion surface that could theoretically be targeted by malicious content in a registry, the implementation is consistent with standard library management workflows and lacks any evidence of exploitation.
- [CREDENTIALS_SAFE]: Instructions for accessing premium blocks correctly emphasize secure secret management, recommending that API keys be stored in local environment files rather than being hardcoded in source files.
Audit Metadata