Skills
Navigate
skills/darkmatter/skills/shadcn-registry-first/Gen Agent Trust Hub

shadcn-registry-first

Pass

Audited by Gen Agent Trust Hub on Nov 3, 2026

Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill instructs the agent to run shell commands to configure registries and install third-party UI components.\n
  • Evidence: bun scripts/setup-components-json.ts and bunx shadcn@latest add @shadcnblocks/<name> --overwrite (SKILL.md).\n- [EXTERNAL_DOWNLOADS]: The skill facilitates the download of code and dependencies from external registries.\n
  • Evidence: Fetches components from the official @shadcn registry and the vendor's @shadcnblocks registry (SKILL.md).\n- [INDIRECT_PROMPT_INJECTION]: The skill processes data from external registries (descriptions and source code) which could contain malicious instructions.\n
  • Ingestion points: search_items_in_registries and get_item_examples_from_registries (SKILL.md).\n
  • Boundary markers: Absent from the provided instructions.\n
  • Capability inventory: Shell execution and filesystem writes via bunx shadcn (SKILL.md).\n
  • Sanitization: Not mentioned for registry-sourced content.
Audit Metadata
Risk Level
SAFE
Analyzed
Nov 3, 2026, 03:50 PM