ai-elements
Pass
Audited by Gen Agent Trust Hub on Sep 20, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill provides instructions to install React components via the command
npx shadcn@latest add https://ai-elements.vercel.app/r/[component-name], which fetches component source code from Vercel's infrastructure. - [INDIRECT_PROMPT_INJECTION]: The library includes components designed to render and process untrusted data from AI responses and user inputs.
- Ingestion points: Data enters the agent context through the
MessageandToolOutputdisplay components, and thePromptInputcomponent for user-provided text and file attachments. - Boundary markers: The documentation does not explicitly detail the use of boundary delimiters or 'ignore' instructions for interpolated content.
- Capability inventory: The components facilitate UI rendering, Markdown processing, and voice input via the Web Speech API.
- Sanitization: The components utilize
Streamdownfor memoized markdown rendering and support standard React state management for handling inputs.
Audit Metadata