add-shadcn-component

SUSPICIOUS: the core shadcn component-generation purpose is coherent, and the shadcn install path appears official and docs-consistent. However, the skill is broader than needed because it requires autonomous commit/sync/push steps, and it couples local code generation to outbound repo updates and a third-party CLI. Main risk is autonomous real-world action plus moderate supply-chain exposure from pnpm dlx @latest.