shadcn
Pass
Audited by Gen Agent Trust Hub on Jun 26, 2026
Risk Level: SAFE
Full Analysis
- [REMOTE_CODE_EXECUTION]: Uses
npx shadcn@latest,pnpm dlx, andbunxto download and execute the latest version of the shadcn CLI from the npm registry. This is the standard, official method for managing shadcn/ui projects. - [COMMAND_EXECUTION]: Utilizes dynamic context injection in
SKILL.md(!npx shadcn@latest info --json) to automatically gather project configuration data such as the framework, Tailwind version, and file paths when the skill is initialized. - [EXTERNAL_DOWNLOADS]: Fetches component documentation, API references, and code examples from official sources including
ui.shadcn.comand associated GitHub repositories. - [COMMAND_EXECUTION]: Provides instructions for searching and installing components from third-party registries, specifically advising the use of
--dry-run,--diff, and--viewflags to audit external source code before it is written to the local file system. - [SAFE]: Instructions for handling private registry authentication (e.g., using
${MY_TOKEN}incomponents.json) follow best practices by referencing environment variables rather than hardcoding credentials.
Audit Metadata