shadcn-ui
Pass
Audited by Gen Agent Trust Hub on Sep 18, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill instructs the use of 'npx shadcn@latest' and 'npx create-next-app@latest', which involves downloading and executing tools from the npm registry. These are well-known and standard tools for React development.
- [COMMAND_EXECUTION]: The documentation includes shell commands for project initialization, component management, and dependency installation using 'npx' and 'npm'.
- [INDIRECT_PROMPT_INJECTION]: The skill provides a surface for the agent to perform project-level modifications via CLI commands based on the library's patterns. 1. Ingestion points: Component documentation and CLI instructions in SKILL.md. 2. Boundary markers: Absent. 3. Capability inventory: Execution of 'npx' and 'npm' commands. 4. Sanitization: Absent; relies on the security of the underlying ecosystem tools.
Audit Metadata