shadcn
Pass
Audited by Gen Agent Trust Hub on Jun 18, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill employs dynamic context injection to run the
infocommand (!npx shadcn@latest info --json) at load time, which allows it to discover project-specific configuration like Tailwind versions and import aliases without manual user input. - [EXTERNAL_DOWNLOADS]: The skill automates the retrieval of UI components and their dependencies from verified registries using the official
shadcnCLI. It also enables the fetching of external documentation and usage examples to ensure component implementation adheres to current standards. - [PROMPT_INJECTION]: An indirect prompt injection surface exists where the agent processes external component documentation and registry metadata; the skill mitigates this by enforcing the use of the CLI's audit, dry-run, and diffing features for manual review before any code is committed.
Audit Metadata