shadcn
Pass
Audited by Gen Agent Trust Hub on Mar 13, 2026
Risk Level: SAFECOMMAND_EXECUTIONREMOTE_CODE_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [COMMAND_EXECUTION]: The skill uses
npx shadcn@latest infoto gather project context, including Tailwind configuration, framework details, and installed components. This information is used to ensure compatibility and correct path resolution for the agent's tasks.\n- [REMOTE_CODE_EXECUTION]: The CLI'saddandinitcommands are used to download and install UI component source code directly into the user's project. The skill supports adding components from various registries and remote URLs, providing a mechanism for expanding the project's UI library.\n- [EXTERNAL_DOWNLOADS]: The skill fetches documentation, examples, and registry metadata from official sources likeui.shadcn.comand configured community registries. This enables the agent to access up-to-date API references and usage patterns.\n- [CREDENTIALS_UNSAFE]: The MCP server documentation describes support for custom registries that can interpolate environment variables (e.g.,${MY_TOKEN}) into authorization headers, facilitating access to private internal registries.\n- [PROMPT_INJECTION]: The skill includes defensive instructions to prevent manual decoding of opaque preset codes, directing the agent to pass them directly to the CLI for safe resolution, which mitigates risks from potentially malicious strings.
Audit Metadata