openui-forge-openai
Pass
Audited by Gen Agent Trust Hub on May 20, 2026
Risk Level: SAFE
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill instructs the user to install several Node.js dependencies, including standard libraries like
openai,zod, andlucide-react, as well as specialized framework packages under the@openuidevnamespace. These downloads are consistent with the skill's stated purpose of building a generative UI application. - [COMMAND_EXECUTION]: Includes standard development commands for project setup, including
npm installfor dependency management andnpx @openuidev/clifor generating system prompts from local configuration files. - [DATA_EXFILTRATION]: Correctly identifies the need for sensitive credentials (
OPENAI_API_KEY) and instructs the user to manage them securely using environment variables (.env.local) rather than hardcoding them into the source code. - [PROMPT_INJECTION]: The provided backend code processes user messages from a POST request and interpolates them into an LLM prompt. While this defines an attack surface for indirect prompt injection, it is a necessary and standard implementation for the intended chat functionality.
Audit Metadata