ui-styling

Pass

Audited by Gen Agent Trust Hub on Sep 19, 2026

Risk Level: SAFE
Full Analysis
  • [COMMAND_EXECUTION]: The script scripts/shadcn_add.py automates the installation of UI components by executing the shadcn CLI through npx. The implementation uses the list-based form of subprocess.run without a shell, which is a secure method for executing external commands.
  • [DYNAMIC_EXECUTION]: The scripts/tailwind_config_gen.py script generates JavaScript and TypeScript configuration files for Tailwind CSS. To mitigate code injection risks (CWE-94), it employs a strict regular expression to validate plugin names before they are included in require() statements in the generated output.
  • [EXTERNAL_DOWNLOADS]: The documentation in SKILL.md and the references/ directory contains instructions for installing well-known, legitimate web development libraries via official package managers (npm, npx). These operations target trusted registries and are standard for the skill's stated purpose.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 19, 2026, 03:50 PM
Security Audit — agent-trust-hub — ui-styling