shadcn
Pass
Audited by Gen Agent Trust Hub on Oct 29, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [REMOTE_CODE_EXECUTION]: The skill facilitates the download and installation of component code from remote sources, including GitHub repositories and arbitrary URLs, through the
npx shadcn@latest addcommand. This behavior is the primary purpose of the shadcn CLI tool and is documented with mitigations such as dry-run previews.\n- [COMMAND_EXECUTION]: The skill utilizes shell commands via package runners such asnpx,pnpm, andbunto execute the shadcn CLI for project initialization, component management, registry operations, and documentation retrieval.\n- [EXTERNAL_DOWNLOADS]: The skill fetches documentation, component source code, and registry metadata from external sources like the officialui.shadcn.comdomain and user-provided endpoints.\n- [INDIRECT_PROMPT_INJECTION]: The skill processes data from project configuration files, CLI outputs, and remote documentation, creating a surface for indirect prompt injection where malicious content in those sources could influence agent behavior during code generation or command execution.\n - Ingestion points: Project configuration files (
package.json,components.json), outputs from shadcn CLI commands (info,docs,view,search), and content from remote GitHub repositories or URLs.\n - Boundary markers: The instructions do not define specific delimiters or instructions to ignore embedded commands within the ingested data, though they do warn the agent not to invent project context.\n
- Capability inventory: The skill possesses the ability to execute shell commands via the shadcn CLI, read local project files, and write or update UI component files.\n
- Sanitization: There is no explicit mention of sanitizing or validating the content retrieved from external sources before it is processed by the agent.
Audit Metadata