canvas-ui-design
Pass
Audited by Gen Agent Trust Hub on Oct 22, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTIONDYNAMIC_EXECUTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill directs the agent to install UI components from the canvasui.dev registry using the npx shadcn CLI, which is a standard and transparent distribution method for frontend components.
- [COMMAND_EXECUTION]: Contains instructions for running local development servers and managing component life cycles via standard shell commands.
- [DYNAMIC_EXECUTION]: The provided WebGL effect logic in docs/canvasui/LiquidVanilla.js utilizes standard browser APIs for shader compilation and GPU resource management, which are necessary for its stated purpose.
- [INDIRECT_PROMPT_INJECTION]: The skill exposes a surface where user requests influence component selection. This risk is minimized by the use of an authoritative reference list in REFERENCE.md and reliance on a specific, non-arbitrary component registry.
Audit Metadata