tailwind-v4-shadcn
Pass
Audited by Gen Agent Trust Hub on Sep 26, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill instructs the agent to install several Node.js packages using
npmandpnpm. These includetailwindcss,@tailwindcss/vite,tw-animate-css,clsx, andtailwind-merge. It also usesnpxto run theshadcn@latestinitialization script. These are standard dependencies for the React/Tailwind ecosystem. - [COMMAND_EXECUTION]: The setup instructions include a command to remove a legacy configuration file (
rm tailwind.config.ts). This is a legitimate step when migrating to Tailwind v4, which uses a CSS-first configuration approach. - [INDIRECT_PROMPT_INJECTION]: The skill represents a surface for indirect prompt injection as it involves the agent reading, processing, and writing local project files (
vite.config.ts,components.json,index.css,tsconfig.json). - Ingestion points: The agent is instructed to check and update project configuration files and source code files in the
src/directory. - Boundary markers: The skill does not define specific delimiters or instructions to ignore content within the files it processes.
- Capability inventory: The agent uses file read/write operations and shell command execution (
rm,npm/pnpm install,npx). - Sanitization: No explicit sanitization or validation of the ingested file content is mentioned beyond the structural templates provided.
Audit Metadata