aceternity-ui
Pass
Audited by Gen Agent Trust Hub on Oct 31, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill fetches component definitions and source code from the official Aceternity registry at
https://ui.aceternity.com/registry/{name}.json. - [COMMAND_EXECUTION]: Utilizes
npx shadcn@latestto initialize project configurations and add external components. This is a standard workflow for shadcn-compatible component libraries. - [INDIRECT_PROMPT_INJECTION]: The skill exposes an attack surface where the AI agent ingests and processes third-party registry JSON files.
- Ingestion points: External JSON registry files from
ui.aceternity.com. - Boundary markers: None; the agent is instructed to read the installed files as the source of truth.
- Capability inventory: Uses the shadcn CLI to write files to the local file system (
components/ui/) and install dependencies. - Sanitization: Not present; the process relies on the integrity of the Aceternity registry.
Audit Metadata