shadcn

SUSPICIOUS: the skill is mostly coherent with its stated shadcn/ui purpose and uses the official shadcn distribution path, but it contains a load-time pre-execution directive that automatically runs an unpinned npm package, and it supports pulling project code from third-party registries/URLs through the CLI. This is not confirmed malware, but it carries meaningful supply-chain and execution-trust risk beyond a normal documentation skill.