ui-craft
Pass
Audited by Gen Agent Trust Hub on Nov 4, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill suggests the installation and use of official, well-known UI component libraries and animation frameworks based on project needs. References include:
- UI Systems: @fluentui/react-components, @shopify/polaris, @material/web, @carbon/react, @salesforce-ux/design-system, @adobe/react-spectrum, @primer/react, govuk-frontend, and @uswds/uswds.
- Animation: motion, gsap, @gsap/react, three, @react-three/fiber, and @react-three/drei.
- Analysis Tools: flesch, write-good, and alex.
- [COMMAND_EXECUTION]: The skill provides instructions for the agent to recommend or perform package installations using 'npm install' for the aforementioned libraries. It also includes an opt-in mechanism to use 'npx playwright screenshot' for visual regression testing and quality evaluation.
- [INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and process local project configuration files and documentation (e.g., .ui-craft/brief.md, tailwind.config.js) to establish design context. This constitutes a standard data ingestion surface for a development tool and does not present an immediate security risk, as the skill's logic is focused on UI generation and auditing.
Audit Metadata