shadcn-code-review
Pass
Audited by Gen Agent Trust Hub on Sep 20, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill consists entirely of instructional markdown and reference code snippets. There are no executable scripts, configuration files, or platform-level commands included in the skill package. No obfuscation, hardcoded credentials, or persistence mechanisms were detected.\n- [INDIRECT_PROMPT_INJECTION]: The skill is designed to analyze untrusted external code (React components). 1. Ingestion points: React component source code provided by the user (as referenced in SKILL.md). 2. Boundary markers: No explicit delimiters or 'ignore' instructions are provided in the skill text. 3. Capability inventory: The skill does not define its own tools or scripts and relies on the model's default toolset. 4. Sanitization: No sanitization or validation of the input code is implemented. This represents a standard surface for indirect prompt injection, but the skill itself contains no malicious instructions or triggers.
Audit Metadata