shadcn-components
Pass
Audited by Gen Agent Trust Hub on Jun 14, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill instructs the agent to use the official shadcn/ui CLI via
npx shadcn@latest addto download component implementations from a well-known, reputable registry. - [COMMAND_EXECUTION]: Shell commands are used to interact with the environment for component installation (
npx), dependency management (pnpm install), and running unit tests (pnpm test). These actions are restricted to the local development environment and are standard for the skill's stated purpose. - [REMOTE_CODE_EXECUTION]: The use of
npxto fetch and execute the shadcn CLI represents a remote code execution vector; however, since it targets a well-known and widely trusted development service, this is considered a standard operation rather than a malicious finding.
Audit Metadata