NYC

ui-styling

Warn

Audited by Gen Agent Trust Hub on Feb 17, 2026

Risk Level: MEDIUMCOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
  • COMMAND_EXECUTION (MEDIUM): The skill documentation encourages the use of shell commands to initialize project configurations and add components, specifically npx shadcn@latest init and npx shadcn@latest add. More importantly, it references local Python automation scripts (scripts/shadcn_add.py and scripts/tailwind_config_gen.py) for component management. Since the source code for these scripts is not included in the skill definition, their behavior cannot be verified.
  • EXTERNAL_DOWNLOADS (MEDIUM): The skill utilizes npm install and npx to fetch and execute packages from the npm registry. While these are standard developer tools, they involve downloading and running external code on the host system. Given that the skill author is not on the trusted organizations list, these operations should be performed with caution.
  • NO_CODE (SAFE): The provided files (SKILL.md and metadata.json) contain instructions and metadata but do not include the implementation of the referenced utility scripts, limiting the ability to perform a full static analysis of the executable logic.
Audit Metadata
Risk Level
MEDIUM
Analyzed
Feb 17, 2026, 06:22 PM