shadcn

Pass

Audited by Gen Agent Trust Hub on Jun 26, 2026

Risk Level: SAFE
Full Analysis
  • [REMOTE_CODE_EXECUTION]: Uses npx shadcn@latest, pnpm dlx, and bunx to download and execute the latest version of the shadcn CLI from the npm registry. This is the standard, official method for managing shadcn/ui projects.
  • [COMMAND_EXECUTION]: Utilizes dynamic context injection in SKILL.md (!npx shadcn@latest info --json) to automatically gather project configuration data such as the framework, Tailwind version, and file paths when the skill is initialized.
  • [EXTERNAL_DOWNLOADS]: Fetches component documentation, API references, and code examples from official sources including ui.shadcn.com and associated GitHub repositories.
  • [COMMAND_EXECUTION]: Provides instructions for searching and installing components from third-party registries, specifically advising the use of --dry-run, --diff, and --view flags to audit external source code before it is written to the local file system.
  • [SAFE]: Instructions for handling private registry authentication (e.g., using ${MY_TOKEN} in components.json) follow best practices by referencing environment variables rather than hardcoding credentials.
Audit Metadata
Risk Level
SAFE
Analyzed
Jun 26, 2026, 06:52 PM
Security Audit — agent-trust-hub — shadcn