The Agent Skills Directory

[COMMAND_EXECUTION]: Executes standard shadcn CLI commands using npx for project initialization and component installation.
[REMOTE_CODE_EXECUTION]: Utilizes npx to run the shadcn CLI, which is the standard and recommended way to interact with the library's registry. This allows the tool to fetch and install the latest versions of UI components directly into the user's project.
[DATA_EXFILTRATION]: Contains explicit security constraints in SKILL.md to redact secrets, local environment paths, and private registry details from agent outputs, reducing the risk of accidental exposure of sensitive information during the integration process.
[EXTERNAL_DOWNLOADS]: Fetches component code and metadata from the official shadcn/ui registry via standard tooling. The skill also recommends installing well-known libraries such as lucide-react, zod, and @tanstack/react-table from the public npm registry.
[INDIRECT_PROMPT_INJECTION]: The skill processes project configuration files (like package.json and components.json) to understand the environment. While this involves reading external data, the risk is mitigated by the skill's focused scope and explicit data redaction rules.
Ingestion points: Project configuration files (package.json, components.json, tailwind.config.js) and existing source code are read during the verification and setup phases.
Boundary markers: Not explicitly detailed, but the skill follows a structured verification workflow to validate project state before performing modifications.
Capability inventory: Access to Bash (for CLI operations), Write (for file modification), and web_fetch (for registry lookups).
Sanitization: The skill emphasizes redacting sensitive information and verifying project readiness before proceeding with any automated changes.

shadcn-ui