react-bits
Pass
Audited by Gen Agent Trust Hub on Apr 18, 2026
Risk Level: SAFE
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill references component installation through
npx shadcn@latest add @react-bits/, which is a recognized and standard pattern for shadcn-compatible component libraries. It also lists several official and well-known NPM packages as dependencies. - [COMMAND_EXECUTION]: The skill provides documentation for standard CLI commands (
npm i,npx shadcn) used in frontend development. These commands are descriptive and align with the skill's stated purpose of helping developers set up UI components. - [PROMPT_INJECTION]: The 'Rules for Claude' section contains benign operational guidelines that help the agent provide better component recommendations. There are no attempts to bypass safety filters, extract system prompts, or override core agent constraints.
- [INDIRECT_PROMPT_INJECTION]: The skill processes user design briefs to suggest components. While this is a data ingestion point, it only results in the recommendation of predefined component names and installation commands, presenting a negligible security risk.
Audit Metadata