shadcn-ui
Pass
Audited by Gen Agent Trust Hub on Mar 4, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill's primary purpose is to facilitate the integration of the shadcn/ui library, adhering to industry best practices and using standard development tools.
- [COMMAND_EXECUTION]: The agent uses the Bash tool to execute the official shadcn CLI for component management and a local diagnostic script (scripts/verify-setup.sh) for project validation. The script performs read-only checks on standard configuration files such as package.json, tsconfig.json, and components.json to ensure the environment is correctly configured.
- [PROMPT_INJECTION]: The skill processes project-specific data (e.g., configuration files) to validate the environment, which represents a surface for indirect prompt injection. Ingestion points: Reads local configuration files (package.json, components.json, tailwind.config.js) via the Read tool and the included diagnostic script. Boundary markers: The skill's instructions are focused on structural validation and checking specific configuration values. Capability inventory: Includes Bash for command execution and Write for file creation. Sanitization: The skill performs structural analysis and pattern matching on configuration values rather than executing instructions contained within the data.
Audit Metadata