gea-ui-components
Pass
Audited by Gen Agent Trust Hub on Apr 3, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSPROMPT_INJECTIONNO_CODE
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill documentation instructs users to install external Node.js packages from the NPM registry, including '@geajs/core', '@geajs/ui', and '@geajs/vite-plugin'. These packages are not associated with a verified or trusted organization.\n- [PROMPT_INJECTION]: The UI components (e.g., Dialog, Alert, Accordion) utilize text properties such as 'title', 'description', and 'label' which serve as ingestion points for data. If an agent populates these components using untrusted external data, it may be vulnerable to indirect prompt injection if that data contains malicious instructions.\n
- Ingestion points: Properties including 'title', 'description', 'label', 'items', and 'content' across multiple components defined in SKILL.md and reference.md.\n
- Boundary markers: The documentation does not specify the use of delimiters or provide instructions to the agent to treat data passed to components as potentially unsafe.\n
- Capability inventory: The skill does not contain any executable scripts, subprocess calls, or dangerous capabilities like file-system access.\n
- Sanitization: There is no mention of sanitization or validation processes for data rendered through the component library.\n- [NO_CODE]: This skill consists solely of markdown documentation files (SKILL.md and reference.md) and does not include any executable scripts or code.
Audit Metadata