pick-ui-library
Pass
Audited by Gen Agent Trust Hub on Oct 2, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill recommends a curated list of frontend libraries hosted on various domains including GitHub, Vercel, and project-specific sites (e.g., base-ui.com, sonner.emilkowal.ski, motion.dev, zustand.docs.pmnd.rs). These are well-established libraries in the web development ecosystem.
- [COMMAND_EXECUTION]: If requested by the user, the skill is instructed to install and wire up the recommended libraries, which involves executing package manager commands (e.g., npm, yarn, or pnpm install).
- [INDIRECT_PROMPT_INJECTION]: The skill reads the project's
package.jsonfile to identify existing dependencies. This constitutes an ingestion point for untrusted external data, though the risk is minimal as it is used only to inform library recommendations and prevent duplicate installations.
Audit Metadata