design
Pass
Audited by Gen Agent Trust Hub on Aug 16, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill references official documentation and guidelines from trusted organizations and well-known services, including shadcn/ui, Tailwind CSS, W3C (WCAG 2.2), Stripe, and Mozilla Developer Network (MDN).
- [INDIRECT_PROMPT_INJECTION]: The skill performs project grounding by reading local configuration files such as
globals.cssandcomponents.json. While this constitutes an ingestion point for external data, the skill uses this information strictly for design consistency and lacks dangerous capabilities like network exfiltration or arbitrary code execution, mitigating injection risks. - [COMMAND_EXECUTION]: The skill provides instructions for using the official shadcn CLI via
bunx shadcn@latest add, which is the standard, documented method for adding components to a project. This is categorized as a safe, functional command within the context of a developer tool. - [DATA_EXPOSURE_&_EXFILTRATION]: No evidence of sensitive file access (e.g., credentials, SSH keys, environment variables) or network exfiltration to untrusted domains was found. All network-related references target established documentation sites.
Audit Metadata