nextjs-shadcn

Pass

Audited by Gen Agent Trust Hub on Oct 26, 2026

Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTIONNO_CODE
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The skill documents the use of the shadcn/ui registry to add components.
  • Evidence: bunx --bun shadcn@latest add command in SKILL.md and component references.
  • Source: Official shadcn registry (ui.shadcn.com).
  • [COMMAND_EXECUTION]: Instructions guide the agent to perform project initialization and component installation.
  • Evidence: Commands like bunx create-next-app@latest and bunx --bun shadcn@latest init are provided in installation.md.
  • Method: Direct execution via package managers.
  • [INDIRECT_PROMPT_INJECTION]: The skill defines a research-based workflow that fetches external data.
  • Ingestion points: fuse-ai-pilot:research-expert tool mentioned in SKILL.md for verifying documentation via Exa/Context7.
  • Boundary markers: Absent; the workflow relies on standard agent behavior for processing documentation.
  • Capability inventory: Shell command execution (bunx, npm) and file system access for project configuration.
  • Sanitization: Absent; implementation depends on agent-level safety filters and human oversight during the development process.
  • [NO_CODE]: The skill does not bundle any executable scripts or binary files.
  • Evidence: All 52 files are markdown documents providing instructions and code samples for the agent to implement.
Audit Metadata
Risk Level
SAFE
Analyzed
Oct 26, 2026, 08:17 PM