The Agent Skills Directory

[SAFE]: No malicious patterns, obfuscation, or unauthorized data access attempts were found. The skill serves its primary purpose of documenting standard frontend development workflows.
[COMMAND_EXECUTION]: The skill provides instructions for executing npx shadcn@latest, which is a standard and well-known command for the shadcn/ui ecosystem. This is documented for project initialization and component installation.
[INDIRECT_PROMPT_INJECTION]: The skill describes processes for fetching external component data and source code via MCP tools and web_fetch. While this defines an ingestion surface for external content, the usage aligns with standard developer workflows for a well-known library.
Ingestion points: Component source code and metadata fetched via get_component, web_fetch, and MCP registry tools (SKILL.md).
Boundary markers: Absent.
Capability inventory: Bash for command execution, Write for file creation, and web_fetch for remote data retrieval.
Sanitization: Absent.
[UNVERIFIABLE_DEPENDENCIES_AND_REMOTE_CODE_EXECUTION]: References to Node.js packages and the npx command are standard for the described UI library and target well-known package registries.

shadcn-ui