launch-shadcn-registry
Pass
Audited by Gen Agent Trust Hub on Aug 24, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [COMMAND_EXECUTION]: The skill uses
gh(GitHub CLI) to fork repositories, clone them, and create pull requests. These operations require manual user authentication and are performed within the/tmpdirectory. Commands are explicitly shown in the instructions and references. - [EXTERNAL_DOWNLOADS]: The skill fetches configuration and data from trusted sources, specifically Cloudflare and the official shadcn-ui GitHub repository, to validate registry entries and check for duplicates.
- [REMOTE_CODE_EXECUTION]: While the skill mentions running a validation script (
scripts/validate-registry.sh), this script is locally provided within the skill package and its operations are limited tocurlandpython3for JSON validation, not executing remote code strings. - [COMMAND_EXECUTION]: The
validate-registry.shscript executescurlto verify that user-provided registry URLs are reachable and return valid JSON. This is a standard validation procedure for registry management.
Audit Metadata