pick-ui-library
Pass
Audited by Gen Agent Trust Hub on Jul 22, 2026
Risk Level: SAFE
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill instructs the agent to read
package.jsonto check for existing dependencies. This constitutes an ingestion point for untrusted data from the user's project, creating a surface for indirect prompt injection. However, the scope is limited to influencing library recommendations. - [EXTERNAL_DOWNLOADS]: The skill facilitates the installation of third-party software by recommending specific Node.js packages and providing links to their documentation and source repositories (e.g., GitHub, Vercel, and author-owned domains).
- [COMMAND_EXECUTION]: The instructions direct the agent to "install/wire up" libraries, which implies the execution of package management commands (like
npm installoryarn add) and file system modifications.
Audit Metadata