ui-styling

Pass

Audited by Gen Agent Trust Hub on Oct 9, 2026

Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
  • [COMMAND_EXECUTION]: The script scripts/shadcn_add.py uses the subprocess module to programmatically execute the npx command-line tool. This is intended to facilitate the automated addition of UI components from the official shadcn/ui registry. The script correctly passes arguments as a list rather than a single string, which prevents potential shell injection attacks.
  • [EXTERNAL_DOWNLOADS]: The skill facilitates downloading code and assets from the npm registry (npmjs.com) and GitHub. These operations are performed via industry-standard package managers like npm and npx, and are essential for retrieving the component libraries described in the documentation.
  • [SAFE]: The skill includes code coverage metadata and artifacts (.coverage, coverage-ui.json) that contain local file paths from the author's development environment. While these files disclose internal path structures, they do not contain sensitive credentials or pose a threat to the execution environment.
Audit Metadata
Risk Level
SAFE
Analyzed
Oct 9, 2026, 04:34 AM