shadcn

Pass

Audited by Gen Agent Trust Hub on Jul 21, 2026

Risk Level: SAFEEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTIONCOMMAND_EXECUTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill uses dynamic context injection (the !command syntax) within SKILL.md to execute npx shadcn@latest info --json when the skill is loaded. This allows the AI agent to automatically synchronize with the local project configuration, including installed components, framework details, and path aliases.
  • [REMOTE_CODE_EXECUTION]: The skill relies on the execution of the shadcn CLI via package runners like npx, pnpm dlx, and bunx. While this pattern downloads and executes code from the NPM registry, it targets a well-known development tool and is limited to explicit project management tasks.
  • [EXTERNAL_DOWNLOADS]: The instructions guide the agent to fetch documentation and code examples from established official sources, specifically ui.shadcn.com and raw.githubusercontent.com, to ensure accurate implementation of UI components.
  • [COMMAND_EXECUTION]: The skill defines and utilizes shell commands via npx, pnpm, and bun to manage the lifecycle of UI components within the user's project, incorporating security best practices such as dry-run and diff checks before applying changes.
Audit Metadata
Risk Level
SAFE
Analyzed
Jul 21, 2026, 10:28 PM
Security Audit — agent-trust-hub — shadcn