Skills
Navigate
skills/shipshitdev/skills/shadcn-setup/Gen Agent Trust Hub

shadcn-setup

Pass

Audited by Gen Agent Trust Hub on Oct 3, 2026

Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill uses a Python script (scripts/setup.py) to automate project setup by executing shell commands via subprocess.run. This includes installing packages via bun and adding UI components via bunx shadcn@latest.
  • [INDIRECT_PROMPT_INJECTION]: The skill processes user-provided component names which are then passed to a shell command (bunx shadcn@latest add ...). This creates a potential surface for indirect prompt injection if the inputs are malicious.
  • Ingestion points: The components list provided via command-line arguments to scripts/setup.py.
  • Boundary markers: None identified.
  • Capability inventory: subprocess.run calls in scripts/setup.py.
  • Sanitization: Basic splitting by comma in main(), but no strict validation of individual component strings.
Audit Metadata
Risk Level
SAFE
Analyzed
Oct 3, 2026, 08:54 AM