shadcn
Pass
Audited by Gen Agent Trust Hub on Jul 9, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTIONCOMMAND_EXECUTION
Full Analysis
- [COMMAND_EXECUTION]: The skill uses dynamic context injection in
SKILL.mdto automatically execute thenpx shadcn@latest infocommand when the skill is loaded, ensuring the agent has up-to-date project context. - [REMOTE_CODE_EXECUTION]: The skill relies on
npxto execute the latest version of theshadcnCLI from the npm registry. It also provides workflows for installing components from remote registries and URLs, while explicitly recommending the use of--dry-runand--diffflags to inspect changes before execution. - [EXTERNAL_DOWNLOADS]: Documentation, examples, and component source code are retrieved from official domains (ui.shadcn.com) and well-known GitHub repositories.
- [CREDENTIALS_UNSAFE]: The skill provides secure guidance for handling private registry authentication by referencing environment variables (e.g.,
${MY_TOKEN}) incomponents.jsonrather than hardcoding credentials.
Audit Metadata