agent-ui
Pass
Audited by Gen Agent Trust Hub on Sep 2, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: Fetches a UI component configuration from the official ui.inference.sh domain using npx shadcn and installs the @inferencesh/sdk package. It also suggests adding related platform skills such as belt-sh/cli. These resources are part of the intended service integration.
- [INDIRECT_PROMPT_INJECTION]: The skill implements a UI that interacts with models and executes browser-based tools, creating a vulnerability surface for indirect instructions.
- Ingestion points: The Agent component receives content from an LLM via the /api/inference/proxy endpoint.
- Boundary markers: The skill instructions lack delimiters to isolate data from model instructions.
- Capability inventory: The skill enables browser-level actions like scan_ui and fill_field as client-side tools.
- Sanitization: No evidence of input validation or human-in-the-loop approval is present in the skill's example code.
Audit Metadata