shadcn-tailwind-ui
Pass
Audited by Gen Agent Trust Hub on Oct 23, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill includes a Python utility (
scripts/generate_tailwind_config.py) to manage configurations and instructs the agent to run it. It also leverages standard project CLI tools such asshadcnand package managers (npm, yarn, pnpm) for project modification. - Evidence:
SKILL.mdcontains examples such aspython <skill-root>/scripts/generate_tailwind_config.py --framework react --format typescript. - Evidence:
tests/test_generate_tailwind_config.pyusessubprocess.runto execute and verify the local configuration script. - [INDIRECT_PROMPT_INJECTION]: The skill context is extended by reading external markdown files from a relative path (
../consult-tavernweave-library/), creating a surface where external content can influence agent behavior. - Ingestion points: References in
SKILL.mdto files under../consult-tavernweave-library/for communication rules and design quality standards. - Boundary markers: Absent; external library content is adopted as a baseline standard without delimiters or override warnings.
- Capability inventory: The agent has capabilities to read/write files via scripts and execute project-level CLI tools.
- Sanitization: No sanitization or validation of the content retrieved from the referenced external files is performed.
Audit Metadata