shadcn-core-registry
Pass
Audited by Gen Agent Trust Hub on Jun 13, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: No malicious patterns or security risks were detected. The skill serves as documentation for the shadcn UI ecosystem.
- [CREDENTIALS_UNSAFE]: The skill explicitly addresses credential safety by advocating for the use of
${ENV_VAR}expansion incomponents.json. It provides specific guidance and anti-pattern examples to prevent the accidental committal of literal API keys or bearer tokens to source control. - [COMMAND_EXECUTION]: The skill references standard CLI usage patterns for the
shadcntool (e.g.,pnpm dlx shadcn@latest add). These references are consistent with the skill's primary purpose of documenting the tool's configuration and registry system. - [EXTERNAL_DOWNLOADS]: The documentation describes the legitimate mechanism by which the
shadcnCLI fetches component manifests from remote registries. It references well-known and trusted services such asui.shadcn.comandv0.dev(Vercel) as examples and default configurations.
Audit Metadata