marketplace-build-component
Pass
Audited by Gen Agent Trust Hub on Mar 4, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- External Component Installation: The skill utilizes
npx shadcnto fetch and install UI components from an external registry atmarketplace-sdk.sitecorecloud.io. This is a common pattern for design systems, allowing for dynamic updates to component libraries. - Command Execution: The instructions include the use of
npxcommands to add components and themes. This capability is necessary for the skill's primary function of building UI, though it requires the agent to execute shell-level operations. - Indirect Data Ingestion Surface: The provided SDK integration patterns include fetching data from an external client (e.g.,
client.query("app.context")). This creates a surface where external data is introduced into the component context. - Ingestion points: Data is fetched in the
useEffecthook of theMyComponentexample inSKILL.md. - Boundary markers: No specific delimiters or "ignore instructions" markers are used in the prompt interpolation example.
- Capability inventory: The skill possesses command execution capabilities via
npxinSKILL.mdandreferences/blok-components.md. - Sanitization: The provided code snippets show basic error handling but do not demonstrate explicit sanitization of the fetched data before it is processed.
Audit Metadata