shadcn
Pass
Audited by Gen Agent Trust Hub on Jul 11, 2026
Risk Level: SAFE
Full Analysis
- [DYNAMIC_CONTEXT_INJECTION]: The
SKILL.mdfile uses the!command`` syntax to executenpx shadcn@latest info --jsonwhen the skill is loaded. This is an informative use of project metadata to provide the agent with project context, such as the framework and installed components. - [EXTERNAL_DOWNLOADS]: The skill facilitates the installation of UI components from various sources, including official registries, community GitHub repositories, and remote URLs. It provides clear instructions to use CLI flags like
--dry-run,--diff, and--viewto audit the code before installation, which is a security best practice. - [COMMAND_EXECUTION]: The skill uses
bashto executeshadcnCLI commands. Theallowed-toolsconfiguration properly restricts the execution environment to theshadcnbinary, ensuring the agent remains within the intended scope.
Audit Metadata