shadcn-management
Pass
Audited by Gen Agent Trust Hub on Oct 12, 2026
Risk Level: SAFE
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes external data from shadcn registries and user search queries to find components. This is a standard requirement for the skill's primary purpose.
- Ingestion points: The skill reads component implementations and examples from registries via
shadcn___view_items_in_registriesandshadcn___get_item_examples_from_registries(referenced in SKILL.md and references/workflows.md). - Capability inventory: The skill suggests shell commands for component installation (
npx shadcn@latest add ...) and generates React code based on registry data. - Boundary markers: Not explicitly defined for external content, but the agent acts on specific API tool outputs.
- Sanitization: Standard usage of official registries is assumed.
- [EXTERNAL_DOWNLOADS]: The skill utilizes the official
npx shadcn@latestcommand for project initialization and component installation, which is a well-known service for frontend development. - [COMMAND_EXECUTION]: The skill provides instructions for the agent to guide the user through running standard initialization and installation commands using the shadcn CLI.
Audit Metadata