shadcn-ui
Pass
Audited by Gen Agent Trust Hub on Sep 20, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSDYNAMIC_CONTEXT_INJECTION
Full Analysis
- [DYNAMIC_CONTEXT_INJECTION]: The skill utilizes the
!command`` syntax (!npx shadcn@latest info --json`) to automatically retrieve project metadata at load time. This enables the agent to adapt its output to the specific framework, package manager, and Tailwind version used in the project without manual user input. The command is limited to non-sensitive project configuration discovery. - [COMMAND_EXECUTION]: Instructions guide the agent to use the
shadcnCLI for managing UI components. This includes commands for initializing projects (init), adding components (add), and applying visual presets (apply). These operations are standard for the tool and include recommendations for using flags like--dry-runand--diffto review changes before execution. - [EXTERNAL_DOWNLOADS]: The skill facilitates the download of component source code and configuration from registries, primarily the official
ui.shadcn.comservice. It provides guidance on auditing third-party registry code using theviewcommand, promoting secure usage of external resources.
Audit Metadata