shadcn
Pass
Audited by Gen Agent Trust Hub on Oct 13, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTIONDYNAMIC_EXECUTION
Full Analysis
- [COMMAND_EXECUTION]: The skill uses Bash to execute npx shadcn@latest and similar package runners. This is a core feature for initializing projects and managing UI components.
- [EXTERNAL_DOWNLOADS]: The skill facilitates downloading components from official registries, GitHub repositories, and external URLs using the shadcn CLI. This is standard functionality for the shadcn ecosystem.
- [INDIRECT_PROMPT_INJECTION]: The skill processes data from project configurations and external registries. It mitigates potential risks by instructing the agent to use CLI flags like --dry-run, --diff, and --view for manual review of incoming code changes.
- [DYNAMIC_EXECUTION]: A specific JavaScript snippet for managing scroll behavior in chat interfaces is provided. This code is static and intended for inclusion in the user's application source code rather than immediate execution by the agent.
Audit Metadata