widgets-ui

Pass

Audited by Gen Agent Trust Hub on Sep 2, 2026

Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The skill instructs the user to download a configuration file from https://ui.inference.sh/r/widgets.json using the shadcn CLI tool. This is a standard practice for adding UI components in the Shadcn UI ecosystem.
  • [COMMAND_EXECUTION]: The documentation includes commands for npx shadcn@latest add and npx skills add. These are installation instructions for the required CLI tools and dependencies and do not represent silent or unauthorized command execution by the skill itself.
  • [INDIRECT_PROMPT_INJECTION]: The skill is designed to process structured JSON to render UIs. While this is an ingestion surface for potentially untrusted data from an agent, the scope is limited to rendering predefined UI widgets, which is the primary purpose of the skill. Standard sanitization is expected at the component level.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 2, 2026, 02:19 PM
Security Audit — agent-trust-hub — widgets-ui