shadcn-core-cli
Pass
Audited by Gen Agent Trust Hub on Jun 13, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSCREDENTIALS_UNSAFE
Full Analysis
- [COMMAND_EXECUTION]: The skill instructs the agent to use standard package managers such as pnpm, npx, and bunx to execute the shadcn CLI. These are standard developer tools for running Node.js binaries.
- [EXTERNAL_DOWNLOADS]: The documentation covers the 'shadcn add' command, which is designed to download component source code from the official shadcn registry or specified remote URLs. This is the primary intended functionality of the tool for code distribution.
- [CREDENTIALS_UNSAFE]: The skill follows security best practices by explicitly instructing users to avoid hardcoding secrets in configuration files. It provides examples of using environment variable interpolation, such as '${REGISTRY_TOKEN}', to securely handle registry authentication.
- [SAFE]: The skill includes an extensive 'Anti-Patterns' section that highlights potential security and functional risks, providing clear remediation guidance for users to maintain project integrity.
Audit Metadata