The Agent Skills Directory

Dynamic Context Injection: The skill utilizes the !command syntax in SKILL.md to execute npx shadcn@latest info --json when it is loaded. This allows the agent to automatically gather project configuration—such as import aliases, Tailwind versions, and installed components—enabling it to provide context-aware responses based on the local environment.
Remote Component Installation: The skill facilitates the installation and updates of UI components via the shadcn CLI (npx shadcn@latest add). This involves downloading source code from designated registries (e.g., ui.shadcn.com or third-party repositories) and integrating it into the user's project, which is the primary distribution method for shadcn/ui.
Indirect Prompt Injection Surface: The instructions guide the agent to fetch and process external documentation and usage examples from URLs provided by the CLI (often originating from ui.shadcn.com or official GitHub repositories). To address potential risks from external content, the skill explicitly instructs the agent to ask the user before defaulting to third-party registries and to verify the integrity of all added files after installation.
Secure Secret Handling: For private registry authentication, the skill recommends using environment variable placeholders (e.g., ${MY_TOKEN}) rather than hardcoded credentials. This aligns with standard security best practices for managing sensitive tokens in configuration files.

shadcn