shadcn

SUSPICIOUS: the skill’s purpose broadly matches its capabilities and official same-org CLI provenance is verifiable, so this is not malware. However, it executes a pre-load npm command via `!` syntax and normalizes use of a mutable `@latest` CLI that can pull code from third-party registries, GitHub refs, arbitrary URLs, and local paths; that makes the install/execution trust footprint larger than a pure documentation skill.