shadcn

Warn

Audited by Runlayer on Feb 21, 2026

Risk Level: MEDIUM
Scan Summary
Max Score
84%
Files
64
Flagged
28
Chunks
65
Flagged Files (28)
references/setup-path-aliases.mdHIGH
83.9%

Malicious tool definition detected

``` **Correct (matching path configuration):** ```json // tsconfig.json { "compilerOptions": { "baseUrl": ".", "paths": { "@/*": ["./src/*"] } } } // components.json { "aliases": { "components": "@/components", "utils": "@/lib/utils", "ui": "@/components/ui" } } ``` **Note:** For Vite projects, also configure the resolve alias in vite.config.ts to match.

references/arch-preserve-radix-primitive-structure.mdHIGH
78.3%

Malicious tool definition detected

Tool: references/arch-preserve-radix-primitive-structure.md Description: --- title: Preserve Radix Primitive Structure impact: CRITICAL impactDescription: maintains keyboard navigation and focus management tags: arch, radix, primitives, compound-components, structure --- ## Preserve Radix Primitive Structure shadcn/ui components are built on Radix primitives with specific parent-child relationships.

references/arch-use-cn-for-class-merging.mdHIGH
78.3%

Malicious tool definition detected

`tailwind-merge` resolves conflicts (last wins for same property) 3.

references/comp-compose-with-compound-components.mdHIGH
78.3%

Malicious tool definition detected

Tool: references/comp-compose-with-compound-components.md Description: --- title: Compose with Compound Component Patterns impact: MEDIUM impactDescription: reduces prop count by 60-80% vs monolithic components tags: comp, compound-components, composition, api-design, patterns --- ## Compose with Compound Component Patterns Build custom components using compound component patterns like shadcn/ui.

references/comp-create-reusable-form-fields.mdHIGH
78.3%

Malicious tool definition detected

Tool: references/comp-create-reusable-form-fields.md Description: --- title: Create Reusable Form Field Components impact: MEDIUM impactDescription: reduces boilerplate and ensures consistency tags: comp, form, field, reusable, composition --- ## Create Reusable Form Field Components Extract common form field patterns into reusable components to reduce boilerplate and maintain consistency across forms.

references/comp-use-drawer-for-mobile-modals.mdHIGH
78.3%

Malicious tool definition detected

const content = ( <> <p className="text-muted-foreground">This action cannot be undone.</p> <div className="flex gap-2 mt-4"> <Button variant="outline" onClick={() => setOpen(false)} className="flex-1"> Cancel </Button> <Button variant="destructive" onClick={onConfirm} className="flex-1"> Delete </Button> </div> </> ) if (isDesktop) { return ( <Dialog open={open} onOpenChange={setOpen}> <DialogTrigger asChild> <Button variant="destructive">Delete</Button> </DialogTrigger> <DialogContent> <Dialog

references/data-empty-states-with-guidance.mdHIGH
78.3%

Malicious tool definition detected

Tool: references/data-empty-states-with-guidance.md Description: --- title: Provide Actionable Empty States impact: MEDIUM-HIGH impactDescription: increases user action rate by 2-4× tags: data, empty-state, ux, guidance, onboarding --- ## Provide Actionable Empty States When displaying empty data (no results, no items), provide context and clear actions rather than just "No data".

references/data-paginate-server-side.mdHIGH
78.3%

Malicious tool definition detected

state: { pagination }, onPaginationChange: setPagination, manualPagination: true, // Tell TanStack Table pagination is server-side getCoreRowModel: getCoreRowModel(), }) return ( <> <Table> <TableBody> {table.getRowModel().rows.map((row) => ( <TableRow key={row.id}> {row.getVisibleCells().map((cell) => ( <TableCell key={cell.id}> {flexRender(cell.column.columnDef.cell, cell.getContext())} </TableCell> ))} </TableRow> ))} </TableBody> </Table> <div className="flex items-center justify-between py-

references/data-use-tanstack-table-for-complex-tables.mdHIGH
78.3%

Malicious tool definition detected

variant="ghost" onClick={() => column.toggleSorting(column.getIsSorted() === "asc")} > Name <ArrowUpDown className="ml-2 h-4 w-4" /> </Button> ), }, { accessorKey: "email", header: "Email", }, { accessorKey: "status", header: "Status", cell: ({ row }) => <Badge>{row.getValue("status")}</Badge>, }, ] function UserTable({ users }: { users: User[] }) { const [sorting, setSorting] = useState<SortingState>([]) const table = useReactTable({ data: users, columns, getCoreRowModel: getCoreRowModel(), get

references/form-handle-async-validation.mdHIGH
78.3%

Malicious tool definition detected

Tool: references/form-handle-async-validation.md Description: --- title: Handle Async Validation with Debouncing impact: HIGH impactDescription: prevents excessive API calls during validation tags: form, async, validation, debounce, api --- ## Handle Async Validation with Debouncing When validating against an API (username availability, email uniqueness), debounce the validation to prevent excessive network requests.

references/form-reset-form-state-correctly.mdHIGH
78.3%

Malicious tool definition detected

"Sending..." : "Send Message"} </Button> </form> </Form> ) } ``` **Reset patterns:** - `form.reset()` - Reset to defaultValues - `form.reset(newValues)` - Reset to specific values - `form.resetField("email")` - Reset single field - `form.clearErrors()` - Clear errors without resetting values **For edit forms (reset to fetched data):** ```tsx const { data: user } = useQuery(["user", userId], fetchUser) const form = useForm<UserFormValues>({ resolver: zodResolver(userSchema), }) useEffect(() => {

references/form-show-validation-errors-correctly.mdHIGH
78.3%

Malicious tool definition detected

const form = useForm<FormValues>({ resolver: zodResolver(schema), mode: "onBlur", // Validates when field loses focus reValidateMode: "onChange", // Re-validates on change after first error }) // User types entire email without interruption // Error only shown when they leave the field // Once error shown, it updates as they fix it ``` **Alternative (validate on submit only):** ```tsx const form = useForm<FormValues>({ resolver: zodResolver(schema), mode: "onSubmit", // Only validates on form su

references/form-use-react-hook-form-integration.mdHIGH
78.3%

Malicious tool definition detected

password: z.string().min(8, "Password must be at least 8 characters"), }) type LoginFormValues = z.infer<typeof loginSchema> function LoginForm() { const form = useForm<LoginFormValues>({ resolver: zodResolver(loginSchema), defaultValues: { email: "", password: "" }, }) const onSubmit = (data: LoginFormValues) => { // Validated data, no re-renders during typing } return ( <Form {...form}> <form onSubmit={form.handleSubmit(onSubmit)} className="space-y-4"> <FormField control={form.control} name="

references/form-use-zod-for-schema-validation.mdHIGH
78.3%

Malicious tool definition detected

username: z .string() .min(3, "Username must be at least 3 characters") .max(20, "Username must be at most 20 characters") .regex(/^[a-zA-Z0-9_]+$/, "Only letters, numbers, and underscores"), age: z.coerce .number() .min(18, "You must be at least 18 years old") .max(120, "Please enter a valid age"), website: z.string().url("Please enter a valid URL").optional().or(z.literal("")), }) type RegistrationFormValues = z.infer<typeof registrationSchema> // TypeScript knows: { email: string; username: s

references/layout-breadcrumb-navigation.mdHIGH
78.3%

Malicious tool definition detected

Reference: [shadcn/ui Breadcrumb](https://ui.shadcn.com/docs/components/breadcrumb)

references/layout-sheet-mobile-nav.mdHIGH
78.3%

Malicious tool definition detected

Tool: references/layout-sheet-mobile-nav.md Description: --- title: Use Sheet for Mobile Navigation Overlay impact: MEDIUM impactDescription: proper mobile navigation with slide-in behavior tags: layout, sheet, mobile, navigation, responsive --- ## Use Sheet for Mobile Navigation Overlay Use Sheet component for mobile navigation that slides in from the edge.

references/layout-sidebar-collapsible.mdHIGH
78.3%

Malicious tool definition detected

Tool: references/layout-sidebar-collapsible.md Description: --- title: Configure Sidebar Collapsible Behavior impact: MEDIUM impactDescription: controls how sidebar collapses on different screen sizes tags: layout, sidebar, collapsible, responsive, mobile --- ## Configure Sidebar Collapsible Behavior Set the `collapsible` prop to control sidebar collapse behavior.

references/layout-sidebar-groups.mdHIGH
78.3%

Malicious tool definition detected

Tool: references/layout-sidebar-groups.md Description: --- title: Organize Sidebar Navigation with Groups impact: MEDIUM impactDescription: improves navigation findability with logical grouping tags: layout, sidebar, groups, navigation, organization --- ## Organize Sidebar Navigation with Groups Use SidebarGroup to organize related navigation items.

references/layout-sidebar-provider.mdHIGH
78.3%

Malicious tool definition detected

Tool: references/layout-sidebar-provider.md Description: --- title: Wrap Layout with SidebarProvider impact: MEDIUM impactDescription: enables sidebar state management across components tags: layout, sidebar, provider, context, state --- ## Wrap Layout with SidebarProvider SidebarProvider must wrap any component that uses sidebar state or controls.

references/perf-avoid-unnecessary-rerenders-in-forms.mdHIGH
78.3%

Malicious tool definition detected

Tool: references/perf-avoid-unnecessary-rerenders-in-forms.md Description: --- title: Avoid Unnecessary Re-renders in Forms impact: MEDIUM impactDescription: prevents full form re-render on every keystroke tags: perf, forms, re-renders, react-hook-form, isolation --- ## Avoid Unnecessary Re-renders in Forms Isolate frequently updating form state to prevent entire form re-renders.

references/perf-debounce-search-inputs.mdHIGH
78.3%

Malicious tool definition detected

Tool: references/perf-debounce-search-inputs.md Description: --- title: Debounce Search and Filter Inputs impact: MEDIUM impactDescription: reduces API calls by 80-90% during typing tags: perf, debounce, search, filtering, api --- ## Debounce Search and Filter Inputs Debounce search inputs to prevent API calls on every keystroke.

references/perf-lazy-load-heavy-components.mdHIGH
78.3%

Malicious tool definition detected

}) const CodeEditor = dynamic(() => import("@/components/code-editor"), { loading: () => <Skeleton className="h-[400px] w-full" />, ssr: false, }) function Dashboard() { const [showChart, setShowChart] = useState(false) const [showEditor, setShowEditor] = useState(false) return ( <div> {/* Components loaded only when rendered */} {showChart && <DataChart data={chartData} />} {showEditor && <RichTextEditor />} </div> ) } ``` **For React without Next.js:** ```tsx import { lazy, Suspense } from "re

references/perf-memoize-expensive-renders.mdHIGH
78.3%

Malicious tool definition detected

Tool: references/perf-memoize-expensive-renders.md Description: --- title: Memoize Expensive Component Renders impact: MEDIUM impactDescription: prevents unnecessary re-renders in lists and data displays tags: perf, memo, useMemo, useCallback, re-renders --- ## Memoize Expensive Component Renders Use `React.memo` for list items and expensive components to prevent re-renders when parent state changes but props remain the same.

references/perf-optimize-icon-imports.mdHIGH
78.3%

Malicious tool definition detected

Tool: references/perf-optimize-icon-imports.md Description: --- title: Optimize Icon Imports from Lucide impact: MEDIUM impactDescription: reduces bundle by 200-500KB with direct imports tags: perf, icons, lucide, tree-shaking, imports --- ## Optimize Icon Imports from Lucide Import Lucide icons directly from their paths or use Next.js optimizePackageImports to avoid loading the entire icon library.

metadata.jsonMEDIUM
61.6%

Tool passed security scan

AGENTS.mdMEDIUM
49.8%

Tool passed security scan

references/setup-css-variables-theme.mdMEDIUM
48.6%

Tool passed security scan

references/setup-components-json.mdMEDIUM
48.1%

Tool passed security scan

Passed Files (36)Click to expand
references/ally-ensure-color-contrast.mdOK
28.7%

Tool passed security scan

references/style-use-tailwind-theme-extend.mdOK
24.3%

Tool passed security scan

references/setup-use-cli-not-copy.mdOK
23.2%

Tool passed security scan

SKILL.mdOK
21.8%

Tool passed security scan

references/style-dark-mode-support.mdOK
21.3%

Tool passed security scan

references/ally-aria-invalid-errors.mdOK
17.7%

Tool passed security scan

references/_sections.mdOK
14.3%

Tool passed security scan

references/arch-extend-variants-with-cva.mdOK
8.7%

Tool passed security scan

references/setup-cn-utility.mdOK
8.0%

Tool passed security scan

references/ally-focus-visible-styles.mdOK
7.6%

Tool passed security scan

README.mdOK
6.3%

Tool passed security scan

references/style-responsive-design-patterns.mdOK
4.8%

Tool passed security scan

references/arch-isolate-component-variants.mdOK
4.6%

Tool passed security scan

references/setup-rsc-configuration.mdOK
4.6%

Tool passed security scan

references/style-consistent-spacing-scale.mdOK
4.2%

Tool passed security scan

references/state-prefer-uncontrolled-for-simple-inputs.mdOK
4.2%

Tool passed security scan

references/comp-combine-command-with-popover.mdOK
4.1%

Tool passed security scan

references/ally-checkbox-label-association.mdOK
4.1%

Tool passed security scan

references/style-use-css-variables-for-theming.mdOK
4.1%

Tool passed security scan

references/data-virtualize-large-lists.mdOK
3.8%

Tool passed security scan

references/ally-form-field-labels.mdOK
3.6%

Tool passed security scan

references/ally-maintain-focus-management.mdOK
3.2%

Tool passed security scan

references/arch-forward-refs-for-composable-components.mdOK
2.9%

Tool passed security scan

references/ally-preserve-keyboard-navigation.mdOK
2.8%

Tool passed security scan

references/ally-dialog-title-required.mdOK
2.7%

Tool passed security scan

references/state-colocate-state-with-components.mdOK
2.4%

Tool passed security scan

references/ally-provide-sr-only-labels.mdOK
2.3%

Tool passed security scan

references/style-avoid-important-overrides.mdOK
2.1%

Tool passed security scan

references/ally-preserve-aria-attributes.mdOK
1.9%

Tool passed security scan

references/arch-use-asChild-for-custom-triggers.mdOK
1.9%

Tool passed security scan

references/data-use-skeleton-loading-states.mdOK
1.8%

Tool passed security scan

assets/templates/_template.mdOK
1.8%

Tool passed security scan

references/comp-use-slot-pattern-for-flexibility.mdOK
1.5%

Tool passed security scan

references/state-lift-state-to-appropriate-level.mdOK
1.4%

Tool passed security scan

references/comp-nest-dialogs-correctly.mdOK
1.4%

Tool passed security scan

references/state-use-controlled-dialog-state.mdOK
1.4%

Tool passed security scan

Audit Metadata
Max File Score
84%
Classification
UNKNOWN_SERVER
Files Scanned
64
Files Flagged
28
Chunks Analyzed
65
Analyzed
Feb 21, 2026, 07:43 AM
Security Audit — runlayer — shadcn