ui-styling
Pass
Audited by Gen Agent Trust Hub on Oct 9, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [COMMAND_EXECUTION]: The script
scripts/shadcn_add.pyuses thesubprocessmodule to programmatically execute thenpxcommand-line tool. This is intended to facilitate the automated addition of UI components from the official shadcn/ui registry. The script correctly passes arguments as a list rather than a single string, which prevents potential shell injection attacks. - [EXTERNAL_DOWNLOADS]: The skill facilitates downloading code and assets from the npm registry (
npmjs.com) and GitHub. These operations are performed via industry-standard package managers likenpmandnpx, and are essential for retrieving the component libraries described in the documentation. - [SAFE]: The skill includes code coverage metadata and artifacts (
.coverage,coverage-ui.json) that contain local file paths from the author's development environment. While these files disclose internal path structures, they do not contain sensitive credentials or pose a threat to the execution environment.
Audit Metadata