shadcn-management

Pass

Audited by Gen Agent Trust Hub on Oct 12, 2026

Risk Level: SAFE
Full Analysis
  • [INDIRECT_PROMPT_INJECTION]: The skill processes external data from shadcn registries and user search queries to find components. This is a standard requirement for the skill's primary purpose.
  • Ingestion points: The skill reads component implementations and examples from registries via shadcn___view_items_in_registries and shadcn___get_item_examples_from_registries (referenced in SKILL.md and references/workflows.md).
  • Capability inventory: The skill suggests shell commands for component installation (npx shadcn@latest add ...) and generates React code based on registry data.
  • Boundary markers: Not explicitly defined for external content, but the agent acts on specific API tool outputs.
  • Sanitization: Standard usage of official registries is assumed.
  • [EXTERNAL_DOWNLOADS]: The skill utilizes the official npx shadcn@latest command for project initialization and component installation, which is a well-known service for frontend development.
  • [COMMAND_EXECUTION]: The skill provides instructions for the agent to guide the user through running standard initialization and installation commands using the shadcn CLI.
Audit Metadata
Risk Level
SAFE
Analyzed
Oct 12, 2026, 03:12 PM