install-kokonutui-component
Pass
Audited by Gen Agent Trust Hub on Aug 21, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill uses the official
shadcnCLI (npx shadcn@latest add) to manage component installation, which is a widely recognized and trusted tool in the React ecosystem.- [SAFE]: All external resources, including the component registry and documentation, are hosted onkokonutui.com, which is the primary domain for the vendor (kokonut-labs).- [SAFE]: Component installation uses the@kokonutuiscoped namespace on npm, ensuring package authenticity relative to the skill author.- [INDIRECT_PROMPT_INJECTION]: The skill retrieves component definitions and documentation from external JSON and Markdown files. This is a standard ingestion surface for component registries. - Ingestion points:
https://kokonutui.com/r/registry.json,https://kokonutui.com/llms.txt, and component Markdown files. - Boundary markers: Not explicitly defined in instructions.
- Capability inventory: Executes shell commands via
npxfor package management. - Sanitization: Relies on the standard
shadcnCLI validation and user inspection of source code.
Audit Metadata