shadcn

Pass

Audited by Gen Agent Trust Hub on Jul 9, 2026

Risk Level: SAFEEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTIONCOMMAND_EXECUTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill uses dynamic context injection in SKILL.md to automatically execute the npx shadcn@latest info command when the skill is loaded, ensuring the agent has up-to-date project context.
  • [REMOTE_CODE_EXECUTION]: The skill relies on npx to execute the latest version of the shadcn CLI from the npm registry. It also provides workflows for installing components from remote registries and URLs, while explicitly recommending the use of --dry-run and --diff flags to inspect changes before execution.
  • [EXTERNAL_DOWNLOADS]: Documentation, examples, and component source code are retrieved from official domains (ui.shadcn.com) and well-known GitHub repositories.
  • [CREDENTIALS_UNSAFE]: The skill provides secure guidance for handling private registry authentication by referencing environment variables (e.g., ${MY_TOKEN}) in components.json rather than hardcoding credentials.
Audit Metadata
Risk Level
SAFE
Analyzed
Jul 9, 2026, 07:08 AM
Security Audit — agent-trust-hub — shadcn