shadcn

Pass

Audited by Gen Agent Trust Hub on Jun 17, 2026

Risk Level: SAFECOMMAND_EXECUTIONREMOTE_CODE_EXECUTIONEXTERNAL_DOWNLOADSPROMPT_INJECTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill uses dynamic context injection (the ! command syntax) in SKILL.md to execute npx shadcn@latest info --json when the skill is loaded, allowing the agent to immediately understand the project's framework and configuration.\n- [REMOTE_CODE_EXECUTION]: Project management tasks are performed by executing the shadcn package via package runners such as npx, pnpm dlx, and bunx. This behavior is transparently documented and strictly restricted to the shadcn CLI tool through the allowed-tools field.\n- [EXTERNAL_DOWNLOADS]: The skill instructs the agent to fetch component documentation, usage examples, and registry metadata from external web resources. These downloads are essential for providing the agent with the correct component APIs and styling patterns.\n- [PROMPT_INJECTION]: The skill processes untrusted data from external URLs and community registries, creating a surface for indirect prompt injection.\n
  • Ingestion points: Documentation URLs, community registry JSON files, and external example files retrieved via the CLI.\n
  • Boundary markers: Absent; the content is ingested directly for project context.\n
  • Capability inventory: Command execution is strictly limited to the shadcn@latest CLI patterns via the allowed-tools configuration.\n
  • Sanitization: Content is evaluated as technical documentation and UI source code.
Audit Metadata
Risk Level
SAFE
Analyzed
Jun 17, 2026, 02:28 PM
Security Audit — agent-trust-hub — shadcn