ai-elements
Pass
Audited by Gen Agent Trust Hub on Feb 21, 2026
Risk Level: SAFE
Full Analysis
- [Indirect Prompt Injection] (LOW): The skill provides components like
JSXPreviewandArtifactthat ingest and render AI-generated content.\n - Ingestion points: The
jsxprop inJSXPreview(references/jsx-preview.md) and thecodeprop inCodeBlock(references/code-block.md).\n - Boundary markers: Not explicitly present in the demo code, though the skill is intended for UI display.\n
- Capability inventory: The components focus on UI rendering (e.g., Markdown, syntax highlighting, icons).\n
- Sanitization:
JSXPreviewutilizesreact-jsx-parserwhich is more secure than raw HTML rendering.\n- [Dynamic Execution] (SAFE): Documentation for theStackTracecomponent includes a backend example that useseval()to generate errors for demonstration. This code is not part of the skill's execution logic.\n- [External Downloads] (SAFE): The skill references assets from trusted domains such asvercel-storage.comandunsplash.com. Theai-elementspackage itself is a standard development library.
Audit Metadata