nextjs-shadcn
Pass
Audited by Gen Agent Trust Hub on Oct 13, 2026
Risk Level: SAFE
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill facilitates the installation of UI components and dependencies through the official shadcn CLI and standard package managers. All external references point to legitimate, well-known domains such as shadcn.com, nextjs.org, and github.com/shadcn-ui.\n- [COMMAND_EXECUTION]: The instructions include standard development commands for project initialization, component management, and linting (e.g., bunx --bun shadcn@latest init, shadcn add, bun run lint). These commands are typical for the described workflow and originate from trusted sources.\n- [INDIRECT_PROMPT_INJECTION]: The skill interacts with project files, creating a potential surface for indirect injection.\n
- Ingestion points: components.json, project source code, and package metadata.\n
- Boundary markers: None explicitly defined in the instructions.\n
- Capability inventory: File system writes, package installation via bun, and component additions via the shadcn CLI.\n
- Sanitization: Relies on standard Next.js architectural patterns (Server Actions, authorization) but lacks specific instruction-level sanitization.
Audit Metadata