ai-elements

Pass

Audited by Gen Agent Trust Hub on Oct 13, 2026

Risk Level: SAFEDYNAMIC_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
  • [DYNAMIC_EXECUTION]: The JSXPreview component (documented in references/jsx-preview.md and demonstrated in scripts/jsx-preview.tsx) uses the react-jsx-parser library to dynamically render JSX from strings. This functionality is intended to allow AI agents to generate and display real-time UI components, which involves parsing and executing code at runtime.
  • [EXTERNAL_DOWNLOADS]: The skill's scripts and documentation reference several external resources from well-known services:
  • Audio files are fetched from Vercel Storage (vercel-storage.com) in scripts/audio-player.tsx.
  • Image assets are referenced from Unsplash (unsplash.com) in scripts/attachments.tsx.
  • Web previews are loaded from Vercel-associated domains (vusercontent.net) in scripts/web-preview.tsx.
  • Integration examples (e.g., scripts/speech-input.tsx) demonstrate how to communicate with the OpenAI API (api.openai.com).
  • [INDIRECT_PROMPT_INJECTION]: The skill is designed to handle and render untrusted data received from large language models (LLMs). While it includes sanitization measures for markdown and uses specialized parsers for UI rendering, the inherent nature of displaying model-generated content creates a surface for indirect prompt injection if the model produces malicious markup.
Audit Metadata
Risk Level
SAFE
Analyzed
Oct 13, 2026, 04:18 AM