lov-install-shadcn-ui
Pass
Audited by Gen Agent Trust Hub on Sep 7, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes project-specific configuration data that could potentially contain malicious instructions.
- Ingestion points: Ingests
package.json,components.json, and project style files to determine configuration as specified in theSKILL.mdWorkflow. - Boundary markers: The
SKILL.mdExecution boundary distinguishes between analysis and modification phases, but does not implement explicit boundary markers or 'ignore' instructions for the data being read. - Capability inventory: The skill possesses file-writing capabilities and can execute shell commands like
npxand build scripts. - Sanitization: There is no explicit validation or sanitization defined for the content of the project files before they are processed by the agent.
- [EXTERNAL_DOWNLOADS]: The skill instructions include installation via the NPM registry.
- Evidence:
README.mdinstructs the user to install the skill usingnpx skills add lov-install-shadcn-ui -g -y.
Audit Metadata