Is ai-app safe to install?

SaferSkills independently audited ai-app (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.

CategoryWeightCategory scoreContribution

Securityprompt, exec, net, exfil, eval

35%

100

35.0 pts

Supply chainhash, typosquat, maintainer, lockfile

20%

100

20.0 pts

Maintenancestaleness, pinning, CI

15%

100

15.0 pts

TransparencySKILL.md, perms, README

15%

100

15.0 pts

Communityinstalls, verify, response

15%

100

15.0 pts

Findings & checks · 0 flagged

Securityscore 100 · 0 findings

✓—All security checks passedNo findings in this category for the latest scan.pass

Supply chainscore 100 · 0 findings

✓—All supply chain checks passedNo findings in this category for the latest scan.pass

Maintenancescore 100 · 0 findings

✓—All maintenance checks passedNo findings in this category for the latest scan.pass

Transparencyscore 100 · 0 findings

✓—All transparency checks passedNo findings in this category for the latest scan.pass

Communityscore 100 · 0 findings

✓—All community checks passedNo findings in this category for the latest scan.pass

The primary manifest — the file an agent reads to learn what this artifact does.

skills/ai-app/SKILL.md · 1 file

skills/ai-app/SKILL.md2.5 KB · Markdown

name: ai-app

description: >-

Builds full-stack Next.js AI applications with the AI SDK and the shadcn/ui

AI Elements patterns.

Use when creating a chatbot, agent dashboard or custom AI application.

AI application setup

Build the requested app around its users, data and operations. Keep the existing stack and SDK major unless migration is part of the task; use Bun for new JavaScript projects.

Resolve the installed AI SDK major through ai-sdk; use ai-sdk-6 or

ai-sdk-7 for implementation. For a new app, default to AI SDK 7: ai@7, @ai-sdk/react@4 and each provider package at latest (provider majors differ; Node.js 22+). Keep v6 only when a required dependency pins it. Build new chat UI from the AI Elements patterns in shadcn/ui (https://ui.shadcn.com/docs/ai-elements); they need no v7 patch. The older elements.ai-sdk.dev library (ai-elements) will be deprecated at the end of November 2026, targets v6, and its context.tsx fails a v7 typecheck until patched. Read version-matched ai/docs/ and provider docs before using web examples.

Use nextjs-shadcn for framework setup and frontend-design for visual

direction. Compose chat UI from the shadcn/ui patterns (Message, Bubble, Message Scroller, Trace; the shadcn skill). For a chatbot, shadcn-ui/chatbot-template is a starting point after upgrading its Next.js (16.3.6) to 16.4.1+. Use ai-elements only for components already copied from elements.ai-sdk.dev. Inspect installed source instead of assuming registry props.

Keep provider credentials and authorization on the server. Resolve model IDs

from configuration or the selected provider's catalog.

Implement the smallest complete user flow. Add persistence, approvals,

attachments, search, suggestions or dashboards when the app needs them.

Match the server stream to the client transport. Verify a second turn,

relevant tool states, safe failures and mobile behavior, alongside the project's typecheck/build.

Read for the app being built

Chatbot: conversation and stream contracts.
Agent dashboard: execution, approval and run state.
Examples: current official implementations.
Project structure: boundaries without a fixed tree.
nextjs-chatbot: durable history, feedback, embedding and production checks.

These references describe requirements, not copyable production templates.

ai-app— agent skill

Is ai-app safe to install?

AI application setup

Read for the app being built

Audit the pieces. Scan the whole. Decide.