The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill instructs the agent to use npx shadcn@latest, which is the official and standard command-line interface for the shadcn/ui library. This is a well-known service used for project initialization and component management.
[COMMAND_EXECUTION]: Includes a local shell script scripts/verify-setup.sh. Analysis shows this script is benign; it performs read-only checks (using grep and find) on project configuration files like components.json, package.json, and tsconfig.json to ensure the project environment is correctly set up.
[DATA_EXFILTRATION]: No evidence of sensitive data access or exfiltration. The included examples (e.g., data-table.tsx) demonstrate standard frontend behaviors such as clipboard interaction (navigator.clipboard.writeText) and simulated form submissions.
[PROMPT_INJECTION]: The instructions in SKILL.md are professional and focused on the technical task of component integration. No patterns were found attempting to override agent safety protocols or bypass constraints.
[REMOTE_CODE_EXECUTION]: While the skill uses npx, it targets a specific, well-known utility. No use of unsafe piping (e.g., curl | bash) from unknown or untrusted sources was detected.

shadcn-ui