shadcn-ui
Pass
Audited by Gen Agent Trust Hub on Oct 23, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: Fetches the full skill package from the official shadcn-ui GitHub repository using the
npx skillsutility. - [COMMAND_EXECUTION]: Executes the
shadcnCLI throughnpxto perform project analysis and component installation, which is the primary intended function of the skill. - [INDIRECT_PROMPT_INJECTION]: The skill processes local project metadata (such as
components.jsonand CLI output) to tailor its responses to the current project environment. While this represents a data ingestion surface, it is a standard and necessary behavior for development-oriented agent skills.
Audit Metadata