ui-design-system
Pass
Audited by Gen Agent Trust Hub on Oct 29, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTION
Full Analysis
- [COMMAND_EXECUTION]: The script 'scripts/shadcn_add.py' uses Python's 'subprocess.run' to execute the 'npx' command for adding UI components. The command is constructed using a list of arguments rather than a shell string, which is a secure implementation that prevents shell injection.
- [EXTERNAL_DOWNLOADS]: The skill documentation and scripts reference the shadcn/ui component library. The 'shadcn_add.py' script invokes 'npx shadcn@latest', which involves downloading the latest version of the utility from the official npm registry. Shadcn is a well-known service in the web development ecosystem.
- [REMOTE_CODE_EXECUTION]: By design, the skill uses the shadcn CLI at runtime to modify the local project's codebase. This behavior is consistent with its stated primary purpose of assisting in the setup and management of a design system.
Audit Metadata