stitch-shadcn-ui
Pass
Audited by Gen Agent Trust Hub on Sep 9, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill provides standard documentation and React code examples for UI development without any malicious logic or hidden execution triggers.
- [CREDENTIALS_UNSAFE]: No hardcoded secrets or sensitive path accesses are present; the instructions specifically mandate that API keys and credential-bearing files must not be committed or stored.
- [EXTERNAL_DOWNLOADS]: All external references target reputable development tools like the shadcn CLI and well-known NPM packages. The skill identifies as being sourced from a trusted Google Labs repository.
- [COMMAND_EXECUTION]: The local verification script
scripts/verify-setup.shis a benign tool that uses standard shell utilities to check project configuration without performing any risky operations. - [DATA_EXFILTRATION]: No network-based exfiltration or data harvesting behaviors were found; the code examples utilize local client-side React state and standard browser APIs.
- [OBFUSCATION]: Thorough analysis confirmed the absence of Base64-encoded commands, zero-width characters, homoglyphs, or any other techniques used to hide malicious intent.
Audit Metadata