Shade dropdown surface contract
Pass
Audited by Gen Agent Trust Hub on Oct 9, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [SAFE]: The skill contains purely technical documentation and design instructions for React UI components. No patterns related to prompt injection, data exfiltration, or unauthorized command execution were found.
- [INDIRECT_PROMPT_INJECTION]: The skill uses the
autoTriggermechanism to process source code files when they are edited. While this creates a data ingestion surface, the lack of dangerous capabilities in the skill makes it a low-risk configuration. - Ingestion points:
apps/shade/src/components/ui/dropdown-menu.tsx,apps/shade/src/components/ui/select.tsx, andapps/shade/src/components/ui/popover.tsx(viafileEdittrigger). - Boundary markers: None specified in the instructions.
- Capability inventory: None. The skill does not perform subprocess calls, file writes, network operations, or dynamic code execution.
- Sanitization: Not applicable, as the skill only provides passive guidance for visual styling and does not output or execute data-driven commands.
Audit Metadata