ui-styling

Pass

Audited by Gen Agent Trust Hub on Sep 1, 2026

Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSDYNAMIC_EXECUTION
Full Analysis
  • [COMMAND_EXECUTION]: The script scripts/shadcn_add.py programmatically executes the npx shadcn command using subprocess.run. This is an intended feature for managing UI components and is executed without a shell, which mitigates the risk of command injection.
  • [EXTERNAL_DOWNLOADS]: The skill utilizes the npx utility to download and run the shadcn CLI from the npm registry. This is standard behavior for the advertised tech stack and targets a well-known, trusted software ecosystem.
  • [DYNAMIC_EXECUTION]: The script scripts/tailwind_config_gen.py generates Tailwind CSS configuration files. It incorporates security-conscious design by using strict regular expression validation on plugin names to prevent code injection via require() statements in the generated output.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 1, 2026, 02:06 PM