liquid-metal-border
Pass
Audited by Gen Agent Trust Hub on Oct 14, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill references the
metal-fxpackage, which is hosted on the public NPM registry and GitHub. These references are used for standard library installation and documentation purposes. - [COMMAND_EXECUTION]: Includes standard package management commands (
npm install,pnpm add,yarn add,bun add) for installing the required dependency. - [INDIRECT_PROMPT_INJECTION]: The skill provides instructions for wrapping React components in a decorative UI wrapper.
- Ingestion points: The skill provides code templates for React components within
SKILL.md. - Boundary markers: Code examples are clearly delimited using standard Markdown triple-backtick blocks.
- Capability inventory: The skill does not perform any subprocess calls, file-system writes, or network operations. It is restricted to rendering UI components in a React environment.
- Sanitization: Not applicable as the skill does not process external user data at runtime.
Audit Metadata