The Agent Skills Directory

[SAFE]: No malicious patterns or security risks were detected in the skill files. All instructions and scripts are consistent with legitimate frontend development workflows.
[COMMAND_EXECUTION]: The skill leverages the Bash tool to execute npx shadcn commands, which is the official method for initializing projects and adding components. These commands are executed locally within the project context.
[EXTERNAL_DOWNLOADS]: The skill facilitates downloading UI component source code from the official shadcn registry via the CLI. All referenced packages are well-known and reputable libraries in the React ecosystem.
[PROMPT_INJECTION]: The skill possesses an indirect prompt injection surface as it processes user input to generate code and manage project files using Bash and Write capabilities. While no specific boundary markers or sanitization steps are documented in SKILL.md, the behavior is inherent to code-generation skills and no malicious intent was observed.

shadcn-ui