shadcn
Pass
Audited by Gen Agent Trust Hub on Jul 21, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTIONCOMMAND_EXECUTION
Full Analysis
- [COMMAND_EXECUTION]: The skill uses dynamic context injection (the
!commandsyntax) withinSKILL.mdto executenpx shadcn@latest info --jsonwhen the skill is loaded. This allows the AI agent to automatically synchronize with the local project configuration, including installed components, framework details, and path aliases. - [REMOTE_CODE_EXECUTION]: The skill relies on the execution of the
shadcnCLI via package runners likenpx,pnpm dlx, andbunx. While this pattern downloads and executes code from the NPM registry, it targets a well-known development tool and is limited to explicit project management tasks. - [EXTERNAL_DOWNLOADS]: The instructions guide the agent to fetch documentation and code examples from established official sources, specifically
ui.shadcn.comandraw.githubusercontent.com, to ensure accurate implementation of UI components. - [COMMAND_EXECUTION]: The skill defines and utilizes shell commands via
npx,pnpm, andbunto manage the lifecycle of UI components within the user's project, incorporating security best practices such as dry-run and diff checks before applying changes.
Audit Metadata