shadcn-svelte
Pass
Audited by Gen Agent Trust Hub on Jul 28, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONREMOTE_CODE_EXECUTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill provides instructions for installing various Node.js packages from the npm registry, including core dependencies like bits-ui, lucide-svelte, formsnap, and sveltekit-superforms.
- [COMMAND_EXECUTION]: The documentation contains numerous examples of shell commands for project setup and component management using the shadcn-svelte CLI (e.g., init and add commands).
- [REMOTE_CODE_EXECUTION]: The skill encourages the use of tools like npx, pnpm dlx, and bun x to execute the shadcn-svelte CLI directly from npm. It also includes examples of downloading project templates using degit from the huntabyte GitHub organization, which is a well-known source for this library.
- [REMOTE_CODE_EXECUTION]: Documentation for the custom registry feature includes examples of adding components from remote URLs, which is an intended architectural feature of the library being documented.
Audit Metadata