skills/rmsite/skills/shadcn-ui/Gen Agent Trust Hub

shadcn-ui

Warn

Audited by Gen Agent Trust Hub on Jun 27, 2026

Risk Level: MEDIUMCOMMAND_EXECUTIONEXTERNAL_DOWNLOADSDATA_EXFILTRATION
Full Analysis
  • [COMMAND_EXECUTION]: The skill instructs the agent to execute various CLI commands via the Bash tool to initialize projects and manage UI components, including npx shadcn, npm install, and pnpm add. These commands involve running scripts and binaries in the local environment.
  • [EXTERNAL_DOWNLOADS]: The documentation and reference files (e.g., SKILL.md, references/official-ui-reference.md) direct the agent to download and install numerous third-party dependencies from the npm registry and component source code from external shadcn registries.
  • [DATA_EXFILTRATION]: Reference material in references/reference.md contains URLs to an external domain (context7.com) where the path separators are partially obfuscated using URL encoding (e.g., http://https:%2F%2Fcontext7.com%2Fwebsites%2Fshadcn_io%2Fllms.txt/thumbnail.jpg). Hiding the structure of external links is a suspicious pattern that can be used to evade security monitoring tools.
Audit Metadata
Risk Level
MEDIUM
Analyzed
Jun 27, 2026, 12:16 PM