add-shadcn-component

Pass

Audited by Gen Agent Trust Hub on May 14, 2026

Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTIONDATA_EXFILTRATION
Full Analysis
  • [COMMAND_EXECUTION]: The skill executes various shell commands to facilitate the development and deployment process.
  • Runs pnpm build to ensure the project compiles correctly after modifications.
  • Uses rg (ripgrep) to search for specific Tailwind CSS color tokens in the newly added components.
  • Performs version control operations using git (status, add, commit, pull, and push).
  • Executes bd sync, which appears to be a project-specific synchronization tool for the 'Beads' workflow.
  • [REMOTE_CODE_EXECUTION]: The skill uses pnpm dlx shadcn@latest to dynamically download and execute the shadcn/ui command-line interface.
  • This fetches the component addition logic directly from the official npm registry at runtime.
  • [EXTERNAL_DOWNLOADS]: Downloads project dependencies and CLI tools via the pnpm package manager.
  • Components are fetched from the standard shadcn/ui registry during the addition phase.
  • [DATA_EXFILTRATION]: The skill includes a git push instruction as part of its landing protocol.
  • This action transmits the updated source code to the remote repository configured in the user's environment.
Audit Metadata
Risk Level
SAFE
Analyzed
May 14, 2026, 06:26 AM
Security Audit — agent-trust-hub — add-shadcn-component