shadcn-setup

Pass

Audited by Gen Agent Trust Hub on Apr 22, 2026

Risk Level: SAFE
Full Analysis
  • [COMMAND_EXECUTION]: The scripts/setup.py script uses subprocess.run to execute package management tasks. It runs bun add and bunx shadcn@latest add to install required libraries and UI components. These commands are executed using argument lists, which prevents shell injection, and are consistent with the skill's primary purpose of project initialization.
  • [EXTERNAL_DOWNLOADS]: The skill facilitates the installation of standard Node.js packages (including tailwindcss, lucide-react, and tailwind-merge) from official package registries. These are well-known and verified dependencies for the shadcn/ui and Tailwind CSS ecosystem.
  • [COMMAND_EXECUTION]: The setup script removes legacy configuration files, such as tailwind.config.js and tailwind.config.ts, using file system operations (path.unlink). This is a documented part of the migration to Tailwind v4's CSS-first configuration and is performative of the skill's stated goal.
Audit Metadata
Risk Level
SAFE
Analyzed
Apr 22, 2026, 07:31 AM