chat-ui
Pass
Audited by Gen Agent Trust Hub on Feb 25, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill fetches component registries and image assets from vendor-controlled domains.
- Evidence: Downloads configuration from
https://ui.inference.sh/r/chat.jsonand fetches preview assets fromhttps://cloud.inference.sh. - [REMOTE_CODE_EXECUTION]: Installation instructions utilize
npxcommands to download and execute component installation scripts from the vendor's registry. - Evidence:
npx shadcn@latest add https://ui.inference.sh/r/chat.jsonandnpx skills addcommands point to vendor-maintained repositories (inference-sh/skills). This is a documented and standard procedure for the shadcn/ui ecosystem and the vendor's own CLI tools.
Audit Metadata