skills/fulldotdev/ui/shadcn/Gen Agent Trust Hub

shadcn

Pass

Audited by Gen Agent Trust Hub on Jun 18, 2026

Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSPROMPT_INJECTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill employs dynamic context injection to run the info command (!npx shadcn@latest info --json) at load time, which allows it to discover project-specific configuration like Tailwind versions and import aliases without manual user input.
  • [EXTERNAL_DOWNLOADS]: The skill automates the retrieval of UI components and their dependencies from verified registries using the official shadcn CLI. It also enables the fetching of external documentation and usage examples to ensure component implementation adheres to current standards.
  • [PROMPT_INJECTION]: An indirect prompt injection surface exists where the agent processes external component documentation and registry metadata; the skill mitigates this by enforcing the use of the CLI's audit, dry-run, and diffing features for manual review before any code is committed.
Audit Metadata
Risk Level
SAFE
Analyzed
Jun 18, 2026, 08:51 AM
Security Audit — agent-trust-hub — shadcn