magic-ui-generator
Pass
Audited by Gen Agent Trust Hub on Oct 15, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill integrates code generated by the Magic by 21st.dev platform into the project codebase. This creates a surface where malicious instructions or code hidden within the external component (e.g., in comments or string literals) could potentially influence the agent's behavior during the integration process.
- Ingestion points: UI component code retrieved from the 21st.dev/magic platform via MCP or browser subagent.
- Boundary markers: The skill does not explicitly instruct the agent to use delimiters or safety wrappers when processing the external code.
- Capability inventory: The agent is instructed to write the generated TypeScript code to the filesystem and install necessary dependencies.
- Sanitization: No explicit validation or sanitization steps are defined for the agent to perform on the external code before it is integrated into the user's project.
Audit Metadata