add-shadcn-component
Pass
Audited by Gen Agent Trust Hub on May 14, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTIONDATA_EXFILTRATION
Full Analysis
- [COMMAND_EXECUTION]: The skill executes various shell commands to facilitate the development and deployment process.
- Runs
pnpm buildto ensure the project compiles correctly after modifications. - Uses
rg(ripgrep) to search for specific Tailwind CSS color tokens in the newly added components. - Performs version control operations using
git(status, add, commit, pull, and push). - Executes
bd sync, which appears to be a project-specific synchronization tool for the 'Beads' workflow. - [REMOTE_CODE_EXECUTION]: The skill uses
pnpm dlx shadcn@latestto dynamically download and execute the shadcn/ui command-line interface. - This fetches the component addition logic directly from the official npm registry at runtime.
- [EXTERNAL_DOWNLOADS]: Downloads project dependencies and CLI tools via the
pnpmpackage manager. - Components are fetched from the standard shadcn/ui registry during the addition phase.
- [DATA_EXFILTRATION]: The skill includes a
git pushinstruction as part of its landing protocol. - This action transmits the updated source code to the remote repository configured in the user's environment.
Audit Metadata