icons

Pass

Audited by Gen Agent Trust Hub on Aug 20, 2026

Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The skill provides instructions to fetch SVG icon files from api.iconify.design. This is a well-known, public API for open-source icons. The downloaded files are static markup data intended to be inlined into a project's source code.
  • [COMMAND_EXECUTION]: The skill utilizes standard command-line tools including curl for querying APIs and bunx (or npx) to execute the shadcn-ui CLI. These commands are used to automate the retrieval of assets and the installation of UI components from established repositories like svgl.app.
  • [REMOTE_CODE_EXECUTION]: While an automated scanner flagged the curl download of an SVG as a potential risk, this is a false positive in the context of this skill. The SVG file is downloaded as a static asset to a local directory and is not executed as a script or binary. The use of shadcn add with a remote URL is a standard mechanism for adding verified UI components to a project.
Audit Metadata
Risk Level
SAFE
Analyzed
Aug 20, 2026, 03:19 PM
Security Audit — agent-trust-hub — icons