tailwind-v4-shadcn

Pass

Audited by Gen Agent Trust Hub on Sep 26, 2026

Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The skill instructs the agent to install several Node.js packages using npm and pnpm. These include tailwindcss, @tailwindcss/vite, tw-animate-css, clsx, and tailwind-merge. It also uses npx to run the shadcn@latest initialization script. These are standard dependencies for the React/Tailwind ecosystem.
  • [COMMAND_EXECUTION]: The setup instructions include a command to remove a legacy configuration file (rm tailwind.config.ts). This is a legitimate step when migrating to Tailwind v4, which uses a CSS-first configuration approach.
  • [INDIRECT_PROMPT_INJECTION]: The skill represents a surface for indirect prompt injection as it involves the agent reading, processing, and writing local project files (vite.config.ts, components.json, index.css, tsconfig.json).
  • Ingestion points: The agent is instructed to check and update project configuration files and source code files in the src/ directory.
  • Boundary markers: The skill does not define specific delimiters or instructions to ignore content within the files it processes.
  • Capability inventory: The agent uses file read/write operations and shell command execution (rm, npm/pnpm install, npx).
  • Sanitization: No explicit sanitization or validation of the ingested file content is mentioned beyond the structural templates provided.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 26, 2026, 11:46 AM