libraries-dev
Pass
Audited by Gen Agent Trust Hub on Oct 24, 2026
Risk Level: SAFE
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill facilitates the installation of several UI effect libraries via npm, including
border-beam,thinking-orbs,liquid-gooey,voice-glow,bot-avatars,metal-fx, andimg-fx. These packages are the primary components of the developer service described in the skill. - [COMMAND_EXECUTION]: The
libraries applycommand triggers shell commands for package installation (e.g.,npm install,pnpm add). The skill's instructions explicitly require the agent to display the full command and obtain user consent before execution. Additionally, the skill mentions a pro-version installation command (npx libraries-dev skill --pro) but strictly forbids the agent from executing it autonomously. - [INDIRECT_PROMPT_INJECTION]: The skill features a
libraries reviewcommand that reads project files, includingpackage.jsonand various configuration files. To mitigate the risk of malicious instructions within these files influencing the agent, the skill includes a dedicated 'Safety' section inSKILL.md. This section instructs the agent to treat all project files as data only and to ignore any embedded commands or instructions to modify its own rules.
Audit Metadata