threenix-add-component
Pass
Audited by Gen Agent Trust Hub on Oct 16, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: Fetches component definitions, source code, and binary assets from the official Threenix developer portal at
https://developers.threenix.io/mcp. This is a vendor-managed resource necessary for the core functionality of the skill.\n- [COMMAND_EXECUTION]: Executes package manager commands (e.g., npm, pip) to install necessary project dependencies and runs build or type-check scripts to verify successful integration of the resources.\n- [INDIRECT_PROMPT_INJECTION]: The skill processes integration notes and runtime guidance from the external Threenix API, which introduces a potential attack surface for indirect prompt injection. This is a functional requirement for the skill to correctly integrate components.\n - Ingestion points: Data is retrieved from the
threenixMCP server via theget_component_referencetool (documented inSKILL.md).\n - Boundary markers: Absent; the skill is explicitly instructed to follow the provided integration guidance.\n
- Capability inventory: Includes the ability to write files to the project, install new dependencies, and execute build/test commands.\n
- Sanitization: Absent; the skill is designed to write returned file content verbatim and follow instruction-based guidance from the API.
Audit Metadata