shadcn-component-discovery
Pass
Audited by Gen Agent Trust Hub on Apr 27, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [COMMAND_EXECUTION]: The skill executes the 'npx shadcn@latest' command to interact with the project environment, including searching registries and installing components.
- [EXTERNAL_DOWNLOADS]: It references multiple community-maintained registries that provide component source code, allowing the agent to integrate external UI patterns into the user's project.
- [SAFE]: Secure practices are encouraged for authenticated registries by using environment variables (e.g., '${ENV_VAR}') for tokens rather than hardcoding credentials.
- [SAFE]: The skill processes data from external registries, presenting a surface for indirect prompt injection. Ingestion points: Metadata and descriptions retrieved during component searches. Boundary markers: Not explicitly defined in the prompts. Capability inventory: Ability to execute shell commands and modify project files. Sanitization: Relies on the curated and community-vetted registries listed in the documentation.
Audit Metadata