nextjs-shadcn
Pass
Audited by Gen Agent Trust Hub on Oct 26, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTIONNO_CODE
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill documents the use of the shadcn/ui registry to add components.
- Evidence:
bunx --bun shadcn@latest addcommand inSKILL.mdand component references. - Source: Official shadcn registry (ui.shadcn.com).
- [COMMAND_EXECUTION]: Instructions guide the agent to perform project initialization and component installation.
- Evidence: Commands like
bunx create-next-app@latestandbunx --bun shadcn@latest initare provided ininstallation.md. - Method: Direct execution via package managers.
- [INDIRECT_PROMPT_INJECTION]: The skill defines a research-based workflow that fetches external data.
- Ingestion points:
fuse-ai-pilot:research-experttool mentioned inSKILL.mdfor verifying documentation via Exa/Context7. - Boundary markers: Absent; the workflow relies on standard agent behavior for processing documentation.
- Capability inventory: Shell command execution (
bunx,npm) and file system access for project configuration. - Sanitization: Absent; implementation depends on agent-level safety filters and human oversight during the development process.
- [NO_CODE]: The skill does not bundle any executable scripts or binary files.
- Evidence: All 52 files are markdown documents providing instructions and code samples for the agent to implement.
Audit Metadata