ui-styling
Pass
Audited by Gen Agent Trust Hub on Sep 19, 2026
Risk Level: SAFE
Full Analysis
- [COMMAND_EXECUTION]: The script
scripts/shadcn_add.pyautomates the installation of UI components by executing theshadcnCLI throughnpx. The implementation uses the list-based form ofsubprocess.runwithout a shell, which is a secure method for executing external commands. - [DYNAMIC_EXECUTION]: The
scripts/tailwind_config_gen.pyscript generates JavaScript and TypeScript configuration files for Tailwind CSS. To mitigate code injection risks (CWE-94), it employs a strict regular expression to validate plugin names before they are included inrequire()statements in the generated output. - [EXTERNAL_DOWNLOADS]: The documentation in
SKILL.mdand thereferences/directory contains instructions for installing well-known, legitimate web development libraries via official package managers (npm,npx). These operations target trusted registries and are standard for the skill's stated purpose.
Audit Metadata