shadcn-tailwind-ui

Pass

Audited by Gen Agent Trust Hub on Oct 23, 2026

Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill includes a Python utility (scripts/generate_tailwind_config.py) to manage configurations and instructs the agent to run it. It also leverages standard project CLI tools such as shadcn and package managers (npm, yarn, pnpm) for project modification.
  • Evidence: SKILL.md contains examples such as python <skill-root>/scripts/generate_tailwind_config.py --framework react --format typescript.
  • Evidence: tests/test_generate_tailwind_config.py uses subprocess.run to execute and verify the local configuration script.
  • [INDIRECT_PROMPT_INJECTION]: The skill context is extended by reading external markdown files from a relative path (../consult-tavernweave-library/), creating a surface where external content can influence agent behavior.
  • Ingestion points: References in SKILL.md to files under ../consult-tavernweave-library/ for communication rules and design quality standards.
  • Boundary markers: Absent; external library content is adopted as a baseline standard without delimiters or override warnings.
  • Capability inventory: The agent has capabilities to read/write files via scripts and execute project-level CLI tools.
  • Sanitization: No sanitization or validation of the content retrieved from the referenced external files is performed.
Audit Metadata
Risk Level
SAFE
Analyzed
Oct 23, 2026, 01:00 PM