pick-ui-library
Pass
Audited by Gen Agent Trust Hub on Jul 22, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill operates as a static reference guide for frontend library selection and does not contain any executable code or instructions that bypass safety protocols.
- [EXTERNAL_DOWNLOADS]: The instructions recommend several external frontend libraries for inclusion in projects. These references point to well-known service providers (such as Vercel) and established open-source project domains. One resource, Sonner, is hosted on a domain associated with the skill's author (emilkowal.ski), which is consistent with the provided author context.
- [PROMPT_INJECTION]: The skill processes user-defined frontend tasks, creating a surface for indirect prompt injection.
- Ingestion points: User-provided task descriptions (e.g., "I need toasts") are matched against the library list in
SKILL.md. - Boundary markers: Absent. No specific delimiters are used to isolate user-provided task descriptions.
- Capability inventory: None. The skill does not have access to tools for file system modification, network requests, or shell execution.
- Sanitization: Absent. User input is processed via natural language matching without explicit escaping or filtering.
Audit Metadata