shadcn-component-discovery

SUSPICIOUS: The skill's purpose is coherent, and its direct use of official shadcn CLI/MCP is consistent with that purpose. However, the skill is fundamentally about steering the agent/user toward numerous third-party registries and external indexes, including free-hosted resources, without validating publisher provenance or endpoint trust. This creates a moderate supply-chain risk through future component installation and optional token-bearing registry access, but there is no evidence of hidden execution, credential theft, or malicious exfiltration in the skill itself.