icons
Pass
Audited by Gen Agent Trust Hub on Aug 20, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill provides instructions to fetch SVG icon files from
api.iconify.design. This is a well-known, public API for open-source icons. The downloaded files are static markup data intended to be inlined into a project's source code. - [COMMAND_EXECUTION]: The skill utilizes standard command-line tools including
curlfor querying APIs andbunx(ornpx) to execute theshadcn-uiCLI. These commands are used to automate the retrieval of assets and the installation of UI components from established repositories likesvgl.app. - [REMOTE_CODE_EXECUTION]: While an automated scanner flagged the
curldownload of an SVG as a potential risk, this is a false positive in the context of this skill. The SVG file is downloaded as a static asset to a local directory and is not executed as a script or binary. The use ofshadcn addwith a remote URL is a standard mechanism for adding verified UI components to a project.
Audit Metadata