skills/shadcn-ui/ui/shadcn/Gen Agent Trust Hub

shadcn

Pass

Audited by Gen Agent Trust Hub on Mar 13, 2026

Risk Level: SAFECOMMAND_EXECUTIONREMOTE_CODE_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
  • [COMMAND_EXECUTION]: The skill uses npx shadcn@latest info to gather project context, including Tailwind configuration, framework details, and installed components. This information is used to ensure compatibility and correct path resolution for the agent's tasks.\n- [REMOTE_CODE_EXECUTION]: The CLI's add and init commands are used to download and install UI component source code directly into the user's project. The skill supports adding components from various registries and remote URLs, providing a mechanism for expanding the project's UI library.\n- [EXTERNAL_DOWNLOADS]: The skill fetches documentation, examples, and registry metadata from official sources like ui.shadcn.com and configured community registries. This enables the agent to access up-to-date API references and usage patterns.\n- [CREDENTIALS_UNSAFE]: The MCP server documentation describes support for custom registries that can interpolate environment variables (e.g., ${MY_TOKEN}) into authorization headers, facilitating access to private internal registries.\n- [PROMPT_INJECTION]: The skill includes defensive instructions to prevent manual decoding of opaque preset codes, directing the agent to pass them directly to the CLI for safe resolution, which mitigates risks from potentially malicious strings.
Audit Metadata
Risk Level
SAFE
Analyzed
Mar 13, 2026, 05:01 AM