The Agent Skills Directory

[COMMAND_EXECUTION]: The skill utilizes the Bash tool to execute npx shadcn commands for project initialization and component installation. It also includes a utility script scripts/verify-setup.sh which performs benign checks on the local project structure, such as verifying the presence of components.json, Tailwind configurations, and TypeScript path aliases.
[EXTERNAL_DOWNLOADS]: The skill facilitates the download of UI components and peer dependencies from the shadcn registry. These operations are performed via the shadcn CLI and npx, which are well-known technology tools. Additionally, installation instructions reference a repository under the google-labs-code organization, which is associated with a trusted vendor.
[INDIRECT_PROMPT_INJECTION]: The skill possesses a potential surface for indirect prompt injection as it retrieves external component source code and documentation for processing.
Ingestion points: External content is ingested via the web_fetch tool and MCP tools like get_component, get_block, and search_items_in_registries.
Boundary markers: Absent; the instructions do not include specific delimiters or warnings to ignore instructions potentially embedded within the retrieved component code.
Capability inventory: The agent has Bash execution, Write access to the local filesystem, and web_fetch capabilities.
Sanitization: Absent; the skill does not explicitly implement content validation or sanitization for the retrieved source code before it is written to the project.

shadcn-ui