stitch-shadcn-ui
Pass
Audited by Gen Agent Trust Hub on Sep 20, 2026
Risk Level: SAFE
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill utilizes
npx shadcn@latestto initialize the environment and add components. This is the standard, official method for using the shadcn/ui CLI tool, which is a well-known and trusted utility in the React ecosystem. - [COMMAND_EXECUTION]: The skill requires the
Bashtool to execute project initialization and component installation commands. These commands are standard for frontend development workflows and do not exhibit suspicious behavior. - [INDIRECT_PROMPT_INJECTION]: The skill is part of a larger workflow that ingests data from other tools (e.g., HTML from
stitch-mcp-get-screen). While this constitutes an ingestion of external data, the skill provides structured mapping tables and manual integration steps, which effectively mitigates the risk of the agent blindly following instructions embedded in the design data.
Audit Metadata