shadcn

SUSPICIOUS: The skill’s purpose and capabilities mostly align with legitimate shadcn/ui development, and the CLI provenance is same-project and officially documented. However, it uses a load-time pre-execution shell command and unpinned `@latest` remote package execution, which raises meaningful supply-chain and trust risk even without clear malicious intent.