shadcn

The skill’s stated purpose is coherent for shadcn/ui development, and the CLI provenance is largely same-org and legitimate. However, the embedded load-time pre-execution directive runs an unpinned remote npm package before any approval, which is a critical execution risk and mandates a malware-level classification under the policy.