libraries-dev
Pass
Audited by Gen Agent Trust Hub on Oct 8, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
- [SAFE]: The skill acts as a developer tool for integrating documented UI libraries. No malicious logic, data exfiltration, or persistence mechanisms were detected. The skill's behavior is consistent with its stated purpose.
- [INDIRECT_PROMPT_INJECTION]: The skill reads project files (code, comments, and configuration) during the
libraries reviewandlibraries applycommands to identify integration points. This processing of potentially untrusted data represents an attack surface for indirect prompt injection. However, the skill includes a dedicated 'Safety' section with explicit instructions for the agent to treat project files strictly as data and ignore any embedded commands, which serves as a robust internal mitigation. - [EXTERNAL_DOWNLOADS]: The skill manages the installation of several npm packages (e.g.,
border-beam,thinking-orbs,img-fx,three). These installations are performed using standard package managers (npm, pnpm, yarn, bun) and follow safety best practices by requiring explicit user confirmation before executing any installation command.
Audit Metadata