shadcn-setup
Pass
Audited by Gen Agent Trust Hub on Apr 22, 2026
Risk Level: SAFE
Full Analysis
- [COMMAND_EXECUTION]: The
scripts/setup.pyscript usessubprocess.runto execute package management tasks. It runsbun addandbunx shadcn@latest addto install required libraries and UI components. These commands are executed using argument lists, which prevents shell injection, and are consistent with the skill's primary purpose of project initialization. - [EXTERNAL_DOWNLOADS]: The skill facilitates the installation of standard Node.js packages (including
tailwindcss,lucide-react, andtailwind-merge) from official package registries. These are well-known and verified dependencies for the shadcn/ui and Tailwind CSS ecosystem. - [COMMAND_EXECUTION]: The setup script removes legacy configuration files, such as
tailwind.config.jsandtailwind.config.ts, using file system operations (path.unlink). This is a documented part of the migration to Tailwind v4's CSS-first configuration and is performative of the skill's stated goal.
Audit Metadata