ikui
Pass
Audited by Gen Agent Trust Hub on Aug 10, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONDATA_EXFILTRATIONREMOTE_CODE_EXECUTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill fetches registry metadata and React component source code from the domain
https://ik-ui.pages.dev. These network operations are essential for the skill's primary function of providing UI components to the project. - [COMMAND_EXECUTION]: The skill instructs the agent to execute shell commands using package runners such as
npx,pnpm, orbunto run theshadcnCLI. These commands are used to initialize projects and add components into the local workspace. - [DATA_EXFILTRATION]: The skill reads the project's
components.jsonfile to access configuration details, such as import aliases and registry settings. This data is used locally to ensure components are installed in the correct directories and with the correct settings. - [REMOTE_CODE_EXECUTION]: By design, the skill uses the
shadcnCLI to download remote source code from the ikui registry and write it directly into the local project files. This is the intended behavior for a shadcn-compatible component registry.
Audit Metadata