widgets-ui
Pass
Audited by Gen Agent Trust Hub on Sep 2, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill instructs the user to download a configuration file from
https://ui.inference.sh/r/widgets.jsonusing theshadcnCLI tool. This is a standard practice for adding UI components in the Shadcn UI ecosystem. - [COMMAND_EXECUTION]: The documentation includes commands for
npx shadcn@latest addandnpx skills add. These are installation instructions for the required CLI tools and dependencies and do not represent silent or unauthorized command execution by the skill itself. - [INDIRECT_PROMPT_INJECTION]: The skill is designed to process structured JSON to render UIs. While this is an ingestion surface for potentially untrusted data from an agent, the scope is limited to rendering predefined UI widgets, which is the primary purpose of the skill. Standard sanitization is expected at the component level.
Audit Metadata