ai-app
Pass
Audited by Gen Agent Trust Hub on Apr 19, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill instructs the agent to execute shell commands using
bunandbunxto initialize projects and install dependencies (e.g.,bunx --bun shadcn@latest create,bun add ai). These are standard operations for a code generation skill.- [EXTERNAL_DOWNLOADS]: Fetches configuration and project presets fromui.shadcn.comand downloads theai-elementspackage. These sources are well-known technology services and the downloads are necessary for the skill's primary function.- [PROMPT_INJECTION]: The skill exhibits an indirect prompt injection surface as it ingests user-provided descriptions and app types to generate project code and run scaffolding commands. - Ingestion points: User-supplied
app-typeanddescriptioninSKILL.md. - Boundary markers: Not present; the user input is used directly to determine project requirements.
- Capability inventory: Subprocess execution via
bunxandbunfor project setup and development server management. - Sanitization: Not present; the skill relies on the agent's internal reasoning to interpret user requirements safely.
Audit Metadata