lov-integrate-agent-uiux
Pass
Audited by Gen Agent Trust Hub on Oct 18, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill provides legitimate developer functionality for scaffolding UI components into existing projects. The core logic is contained in local Python scripts that handle file system operations (auditing and copying assets) in a deterministic and localized manner.
- [DATA_EXPOSURE_AND_EXFILTRATION]: The skill manages local state and user preferences using a dedicated profile store script (
scripts/profile_store.py). This script implements a security filter to prevent the accidental persistence of sensitive data such as API keys, tokens, or passwords, ensuring that only user-authorized configuration is saved to the local configuration directory. - [INDIRECT_PROMPT_INJECTION]: The bundled UI components include a custom Markdown renderer that prioritizes security by validating URL protocols. The
safeAgentLinkutility inassets/common/model.tsrestricts link execution to safe protocols (http, https, mailto, tel), mitigating potential URI-based injection risks. The components render content using standard platform primitives without resorting to unsafe methods like dangerouslySetInnerHTML.
Audit Metadata