constructive-ui
Pass
Audited by Gen Agent Trust Hub on Mar 5, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill uses a custom shadcn registry hosted at 'https://constructive-io.github.io/dashboard/r/{name}.json' to distribute component source code. This is the official repository for the 'constructive-io' vendor and follows established patterns for modern React component libraries.
- [COMMAND_EXECUTION]: Instructions are provided for installing components via the 'npx shadcn add' command. This facilitates the retrieval and integration of component code into the host project as part of the intended developer experience.
- [PROMPT_INJECTION]: Interactive components such as the 'CommandPalette', 'Autocomplete', and 'Combobox' ingest and process user-supplied input for filtering and selection. While these are standard UI features, they represent a surface for indirect input that should be handled with standard application-level sanitization.
- [DATA_EXPOSURE]: The skill manages client-side UI state, such as dark mode preferences and sidebar visibility, using 'localStorage' and browser cookies (e.g., 'sidebar_state'). These operations are limited to non-sensitive configuration data and do not involve sensitive user information or credentials.
Audit Metadata