tailwind
Pass
Audited by Gen Agent Trust Hub on Oct 10, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill instructs the agent to read external documentation from tailwindcss.com and ui.shadcn.com, as well as process local project files. This creates a surface where malicious instructions embedded in those sources could influence the agent's behavior.\n
- Ingestion points: SKILL.md (external documentation URLs) and project-specific CSS/TSX files.\n
- Boundary markers: Absent. No specific delimiters or instructions to ignore embedded content are provided.\n
- Capability inventory: Shell command execution (bunx, pnpm, windlint) and file system modification.\n
- Sanitization: Absent.\n- [COMMAND_EXECUTION]: The skill recommends the use of shell commands for project management and migration, including
bunx shadcn@latestandbunx @tailwindcss/upgrade. It also utilizeswindlint, a class-renaming utility from the skill author's own toolset.\n- [EXTERNAL_DOWNLOADS]: The skill references and recommends the installation of several reputable and well-known NPM packages, such as @base-ui/react and radix-ui, as well as official Tailwind upgrade tools.
Audit Metadata