ui-styling
Pass
Audited by Gen Agent Trust Hub on Sep 1, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSDYNAMIC_EXECUTION
Full Analysis
- [COMMAND_EXECUTION]: The script
scripts/shadcn_add.pyprogrammatically executes thenpx shadcncommand usingsubprocess.run. This is an intended feature for managing UI components and is executed without a shell, which mitigates the risk of command injection. - [EXTERNAL_DOWNLOADS]: The skill utilizes the
npxutility to download and run theshadcnCLI from the npm registry. This is standard behavior for the advertised tech stack and targets a well-known, trusted software ecosystem. - [DYNAMIC_EXECUTION]: The script
scripts/tailwind_config_gen.pygenerates Tailwind CSS configuration files. It incorporates security-conscious design by using strict regular expression validation on plugin names to prevent code injection viarequire()statements in the generated output.
Audit Metadata