specsfy-specialist-reui
Pass
Audited by Gen Agent Trust Hub on Aug 24, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill facilitates downloading UI component code and configurations from the official vendor domain reui.io. This is performed via a custom registry configuration in components.json.
- [COMMAND_EXECUTION]: The skill instructs the agent to use standard package management and CLI tools, including npm install, npx shadcn@latest init, and npx shadcn@latest add. These commands are used for project initialization and component deployment.
- [PROMPT_INJECTION]: The skill processes project-specific requirements from INTERFACE.md to guide its code generation. While this is an expected behavior for a UI specialist, it represents a surface where external documentation influences the agent's output.
- Ingestion points: INTERFACE.md (referenced in the Fluxo section of SKILL.md)
- Boundary markers: Absent; no specific instructions to ignore embedded commands within the interface specification.
- Capability inventory: Shell command execution via npx shadcn, dependency installation via npm, and writing React component files to the local filesystem.
- Sanitization: Absent; the skill relies on the agent to interpret the markdown description without formal validation.
Audit Metadata