widgets-ui
Pass
Audited by Gen Agent Trust Hub on Aug 17, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill documentation provides instructions to download and install UI components from the inference.sh domain using the shadcn CLI tool (e.g., npx shadcn@latest add https://ui.inference.sh/r/widgets.json). This is a standard integration pattern for the service provided.- [COMMAND_EXECUTION]: The skill recommends the installation of the belt-sh/cli tool and other related skills using the npx command as part of the setup process.- [INDIRECT_PROMPT_INJECTION]: The skill functions as a UI renderer for agent responses, creating an attack surface where untrusted data could influence UI output. * Ingestion points: widget prop in WidgetRenderer (SKILL.md). * Boundary markers: None identified in the provided snippet. * Capability inventory: Rendering text, buttons with actions, forms, and layout components. * Sanitization: Not explicitly documented in the provided file.
Audit Metadata