shadcn
Pass
Audited by Gen Agent Trust Hub on Aug 3, 2026
Risk Level: SAFE
Full Analysis
- [COMMAND_EXECUTION]: The skill utilizes dynamic context injection (exclamation mark and backtick syntax) in SKILL.md to execute 'npx shadcn@latest info --json'. This command retrieves project-specific configuration (such as framework, aliases, and paths) to adapt the agent's behavior to the user's environment. This is a legitimate application of project-specific discovery tooling.- [EXTERNAL_DOWNLOADS]: The skill interacts with the official shadcn registry and fetches documentation and examples from well-known services like ui.shadcn.com and github.com. These actions are core to the skill's functionality for searching, viewing, and installing UI components.- [PROMPT_INJECTION]: The skill instructs the agent to fetch and process external component documentation and usage examples. While this establishes an indirect prompt injection surface, the risk is minimal and considered safe as the instructions direct the agent to trusted official registries and well-known documentation sources.
Audit Metadata