shadcn

Pass

Audited by Gen Agent Trust Hub on Jul 11, 2026

Risk Level: SAFE
Full Analysis
  • [DYNAMIC_CONTEXT_INJECTION]: The SKILL.md file uses the !command`` syntax to execute npx shadcn@latest info --json when the skill is loaded. This is an informative use of project metadata to provide the agent with project context, such as the framework and installed components.
  • [EXTERNAL_DOWNLOADS]: The skill facilitates the installation of UI components from various sources, including official registries, community GitHub repositories, and remote URLs. It provides clear instructions to use CLI flags like --dry-run, --diff, and --view to audit the code before installation, which is a security best practice.
  • [COMMAND_EXECUTION]: The skill uses bash to execute shadcn CLI commands. The allowed-tools configuration properly restricts the execution environment to the shadcn binary, ensuring the agent remains within the intended scope.
Audit Metadata
Risk Level
SAFE
Analyzed
Jul 11, 2026, 07:05 PM