Skills agent-ui
📦

agent-ui

Content revision r1 Safe ⚙️ External commands🌐 Network access🔑 Env variables

Build React Agent Interfaces

Teams need agent chat interfaces without rebuilding streaming, approvals, and tool displays. This skill guides setup of the inference.sh Agent component in React and Next.js.

Supports: Claude Codex Code(CC)
🥉 78 Bronze

Install with my Agent

Copy this request to your Agent. It includes the canonical Skill page and manifest.

Agent request
Review the Skillstore skill "agent-ui" from https://skillstore.io/skills/inference-sh-9-agent-ui.md and its manifest at https://skillstore.io/api/skills/inference-sh-9-agent-ui/manifest. Verify the artifact. You may proceed after verification, subject to the environment's own policy.

Your Agent should still show its plan and request any confirmation required by the security policy.

Agent-readable resources

Use these links when an AI agent, crawler, or script needs clean context instead of reading the full page.

Markdown detail GET /skills/inference-sh-9-agent-ui.md Signed manifest GET /api/skills/inference-sh-9-agent-ui/manifest Signed lockfile GET /api/skills/inference-sh-9-agent-ui/lockfile

Test it

Using "agent-ui". Add the component to a new Next.js dashboard.

Expected outcome:

  • Installation steps for the shadcn component and inference.sh SDK.
  • Proxy route placement and environment variable reminders.
  • Component usage notes for the dashboard page.

Using "agent-ui". Plan an agent that can fill a form after approval.

Expected outcome:

A tool design that scans form fields, requests confirmation, validates inputs, and reports completion without hiding user control.

Using "agent-ui". Review security before launch.

Expected outcome:

A checklist covering remote package trust, environment variable storage, upload permissions, model configuration, and approval handling.

Security Audit

Safe
v6 • 7/9/2026 Open versioned report

The skill is mostly documentation for installing and using a React and Next.js agent component. Most static shell, environment, and URL detections are markdown examples or normal documentation links. Confirmed risks are remote install commands and a hosted image that depend on external infrastructure.

1
Files scanned
120
Lines analyzed
4
Review items
0
False positives ignored
Capability review items (4)

These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.

Medium
SKILL.md:14-20
Ruby/shell backtick execution
```bash
The quick-start block instructs users to run npx and npm install commands that modify a project and install remote dependencies. This is legitimate setup guidance, but it creates supply-chain and command execution risk if followed blindly.
Medium
SKILL.md:100-109
Ruby/shell backtick execution
```bash
The related-skills block instructs users to run npx skills add commands that install additional community skills. This is intended behavior, but it can pull unreviewed external content into the environment.
Medium
SKILL.md:16
Hardcoded URL
npx shadcn@latest add https://ui.inference.sh/r/agent.json
The hardcoded URL is passed to an npx shadcn add command that retrieves component metadata or code from a third-party host. That creates a real remote install and supply-chain trust risk.
Low
SKILL.md:10
Hardcoded URL
![Agent Component](https://cloud.inference.sh/app/files/u/4mg21r6ta37mpaz6ktzwtt8krr/01kgvftp7hb8wby
The markdown embeds a remote image from cloud.inference.sh. Rendering it may contact an external host and create a minor tracking or availability dependency.

Risk Factors

⚙️ External commands (16)
SKILL.md:14-20 SKILL.md:20-26 SKILL.md:26-30 SKILL.md:30-34 SKILL.md:34-37 SKILL.md:37-41 SKILL.md:41-56 SKILL.md:56-71 SKILL.md:71-86 SKILL.md:86-92 SKILL.md:92-93 SKILL.md:93-94 SKILL.md:94-95 SKILL.md:95-96 SKILL.md:96-100 SKILL.md:100-109
🌐 Network access (9)
SKILL.md:8 SKILL.md:10 SKILL.md:16 SKILL.md:113 SKILL.md:114 SKILL.md:115 SKILL.md:116 SKILL.md:117 SKILL.md:119
🔑 Env variables (1)
SKILL.md:36
Audited by: codex View Audit History →
Share & cite this report

Share the versioned assessment report, neutral badge, embed card, and citations. Skillstore reports evidence without deciding whether this Skill is safe.

Open versioned report
Security Assessment

Copy report link

https://skillstore.io/skills/inference-sh-9-agent-ui/audits/6?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_report

Markdown badge

[![Skillstore security assessment](https://skillstore.io/badges/skills/inference-sh-9-agent-ui/security.svg)](https://skillstore.io/skills/inference-sh-9-agent-ui?utm_source=security_passport_badge)

HTML badge

<a href="https://skillstore.io/skills/inference-sh-9-agent-ui?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/inference-sh-9-agent-ui/security.svg" alt="Skillstore security assessment" loading="lazy"></a>

Embed card

<iframe src="https://skillstore.io/embed/skills/inference-sh-9-agent-ui.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>
Academic citations (APA · BibTeX · CFF)

APA citation

inference-sh-9. (2026). agent-ui security audit report (audit version 6) [Author version unspecified]. Skillstore. https://skillstore.io/skills/inference-sh-9-agent-ui/audits/6

BibTeX citation

@techreport{inference-sh-9-inference-sh-9-agent-ui-2026, author = {inference-sh-9}, title = {agent-ui security audit report (audit version 6)}, institution = {Skillstore}, year = {2026}, number = {6}, url = {https://skillstore.io/skills/inference-sh-9-agent-ui/audits/6}, note = {Author version unspecified} }

CITATION.cff

cff-version: 1.2.0 message: "If you use this Skill, cite its author and this versioned security audit report." title: "agent-ui security audit report (audit version 6)" version: "unspecified" type: report authors: - name: "inference-sh-9" date-released: "2026-07-09" url: "https://skillstore.io/skills/inference-sh-9-agent-ui/audits/6" identifiers: - type: other value: "skillstore:inference-sh-9-agent-ui:audit:6" description: "Skillstore immutable audit report identifier"

Compare variants

3 installable variants

Each author remains a separate installable skill. The recommended variant is ranked by Skillstore evidence.

Why this variant is first

Higher Skillstore usage
inference-sh-9 Recommended Current

inference-sh-9-agent-ui

Skillstore Score 78
Evidence Confidence High
Skillstore usage 14
Updated

2026-08-21

inference-sh

inference-sh-agent-ui

Skillstore Score 78
Evidence Confidence High
Skillstore usage 12
Updated

2026-08-21

inferen-sh

inferen-sh-agent-ui

Skillstore Score 69
Evidence Confidence High
Skillstore usage 6
Updated

2026-08-21

Skillstore Score

Why this score Evidence Confidence: High
55
Architecture
85
Maintainability
87
Content
69
Community
83
Spec Compliance

What You Can Build

Add an Agent Chat Surface

A frontend developer can add a ready-made agent interface to a Next.js page with streaming and file options.

Prototype a SaaS Copilot

A product team can test assistant workflows with approvals, widgets, and client-side tools before custom implementation.

Standardize Agent Runtime Setup

An AI platform engineer can document proxy routing, API key setup, and component configuration for internal teams.

Try These Prompts

Set Up Agent Component 
Help me add the agent UI component to a Next.js app. Explain the install steps, proxy route, and required environment variable.
Configure Chat Behavior 
Plan an agent configuration for a SaaS support assistant. Include model choice, system prompt goals, and safe approval behavior.
Add Client Tools 
Design browser-side tools for filling a customer form with human approval. Describe state handling, validation, and user confirmation.
Review Agent Integration 
Audit my planned agent UI integration for security and user experience. Check remote installs, API key handling, file uploads, and approval flows.

Best Practices

  • Review downloaded component code before committing it to your application.
  • Keep API keys in local or managed secrets and exclude them from version control.
  • Use human approval for tools that modify data, submit forms, or upload files.

Avoid

  • Do not run remote install commands from community skills without review.
  • Do not expose API keys in client-side code or public repositories.
  • Do not enable file or image uploads without validation and clear user consent.

Frequently Asked Questions

What does this skill help me build?
It helps you add an agent chat interface to React or Next.js applications using the inference.sh Agent component.
Does it include the component source code?
No. It provides setup guidance and points to the external registry that supplies the component.
Can I use it with Claude, Codex, or Claude Code?
Yes. The marketplace metadata declares support for Claude, Codex, and Claude Code workflows.
Do I need an inference.sh API key?
Yes. The setup example requires an INFERENCE_API_KEY value stored outside source control.
Does it support human approval flows?
Yes. The documented component features include tool lifecycle states and human-in-the-loop approval flows.
What should I review before production use?
Review remote component code, SDK dependency versions, API key handling, upload settings, and any client-side tools.

Developer Details

License

MIT

Skillstore revision

r1

Version notice

The author did not declare a version.

Repository

https://github.com/inference-sh-9/skills/tree/main/skills/agent-ui/

Ref

0519034dad657fb1f7706e0550e962beeda73fdf

Maintenance freshness

7/18/2026

Usage

6 downloads · 104 views

File structure

📄 SKILL.md