marketplace-build-component

Pass

Audited by Gen Agent Trust Hub on Mar 4, 2026

Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
  • External Component Installation: The skill utilizes npx shadcn to fetch and install UI components from an external registry at marketplace-sdk.sitecorecloud.io. This is a common pattern for design systems, allowing for dynamic updates to component libraries.
  • Command Execution: The instructions include the use of npx commands to add components and themes. This capability is necessary for the skill's primary function of building UI, though it requires the agent to execute shell-level operations.
  • Indirect Data Ingestion Surface: The provided SDK integration patterns include fetching data from an external client (e.g., client.query("app.context")). This creates a surface where external data is introduced into the component context.
  • Ingestion points: Data is fetched in the useEffect hook of the MyComponent example in SKILL.md.
  • Boundary markers: No specific delimiters or "ignore instructions" markers are used in the prompt interpolation example.
  • Capability inventory: The skill possesses command execution capabilities via npx in SKILL.md and references/blok-components.md.
  • Sanitization: The provided code snippets show basic error handling but do not demonstrate explicit sanitization of the fetched data before it is processed.
Audit Metadata
Risk Level
SAFE
Analyzed
Mar 4, 2026, 06:45 PM