shadcn
Pass
Audited by Gen Agent Trust Hub on Apr 29, 2026
Risk Level: SAFE
Full Analysis
- [COMMAND_EXECUTION]: Employs dynamic context injection through the
!npx shadcn@latest info --jsoncommand inSKILL.mdto automatically synchronize with the user's project settings at load time, which is an expected and legitimate use of project-specific tooling. - [COMMAND_EXECUTION]: Orchestrates UI component management using the
shadcnCLI (vianpx,pnpm, orbun), performing actions such as searching, adding, and viewing components as intended. - [EXTERNAL_DOWNLOADS]: Retrieves component registries and documentation from well-known and trusted services, specifically
ui.shadcn.comand official GitHub repositories viaraw.githubusercontent.com. - [COMMAND_EXECUTION]: Supports installing components from external URLs via the
addcommand, while providing instructions to use the--viewflag to inspect source code before installation. - [SAFE]: Implements a high standard of security through instructions that require the agent to use
--dry-run,--diff, and--viewflags for all updates, ensuring that users can review changes before they are applied to the filesystem.
Audit Metadata