shadcn

The skill's stated purpose matches its use of the shadcn CLI and project config, and most flagged credential/prompt findings are benign documentation context. However, the embedded `!` pre-execution command runs `npx shadcn@latest` at skill-load time, which is remote code execution before approval; under the mandatory override this makes the skill high risk and near-certain malicious in classification despite otherwise coherent purpose.