Shadcn Ui

• Outcome: Pass
• Latest audit: Sep 16, 2026 · 9:42 AM UTC
• Version: 1.0.1

Overview

This is a shadcn/ui coding helper with disclosed project-modifying CLI examples; its main caveat is unpinned npm commands that users should run carefully.

Before installing or using this skill, treat the shadcn CLI commands as project-mutating commands: prefer a pinned or lockfile-controlled CLI version when possible, avoid `--all` and `--overwrite` unless needed, run commands only in the intended app root, and review the resulting file changes before committing.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:24

Finding

Execution of an Unpinned Mutable npm Package Through npx

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 24–48
Vulnerability Type: T08: Insecure Dependencies
Risk Level: Medium

Vulnerable code:

bash

npx shadcn@latest init

bash

# Add a single component
npx shadcn@latest add button

# Add multiple components
npx shadcn@latest add button card dialog

# Add all available components
npx shadcn@latest add --all

markdown

**Important:** The package name changed in 2024:
- Old (deprecated): `npx shadcn-ui@latest add`
- Current: `npx shadcn@latest add`

Technical Analysis

The Skill instructs users or agents to execute shadcn@latest directly through npx. The latest tag is mutable and does not identify an immutable, previously reviewed package release. Depending on the local npm configuration and cache, npx can download the currently published package and immediately execute its CLI code with the invoking user's permissions.

No lockfile, exact version, package integrity value, or independent verification step is specified for these commands. Consequently, the effective executable payload may change after the Skill itself has been reviewed. This creates a supply-chain exposure if the upstream package, publisher account, registry delivery path, or a future release is compromised. The add --all command also broadens the affected dependency and generated-file surface.

The audit did not find evidence that the named package is currently malicious. The risk arises from executing a mutable, unpinned third-party release.

Attack Path

1. An attacker compromises the upstream package publisher, release process, or registry-hosted package version associated with the latest tag.
2. The compromised release includes malicious install-time or CLI-execution code.
3. A user or agent follows SKILL.md and runs an instructed npx shadcn@latest ... command.
4. npx resolves and downloads the attacker-controlled re ...[truncated 924 chars]

Remediation

View remediation

Remediation Suggestions

1. Replace @latest with an exact, reviewed version, for example npx shadcn@X.Y.Z, after selecting and validating an appropriate release.
2. Prefer adding the CLI as a pinned development dependency through the project's package manager and committing the resulting lockfile.
3. Use deterministic installation modes, such as npm ci, in automated environments so dependency resolution follows the reviewed lockfile.
4. Verify registry provenance, package integrity, publisher identity, and release notes before updating the pinned version.
5. Run the CLI with a non-privileged account in an isolated workspace or container with only the required project directory mounted.
6. Review the exact files and dependency changes produced by init or add before accepting them.
7. Retain the documented working-directory and overwrite gates, and require explicit approval before using --all or --overwrite.
8. Establish a controlled update process in which version changes are separately reviewed and tested before adoption.

SkillSpector

Vulnerability Patterns

• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (9)

Self-Modification

High

• Category: Rogue Agent
• Confidence: 85% confidence

Finding

Skill modifies its own code, configuration, or behavior at runtime. Self-modification enables an agent to escalate privileges, disable safety constraints, or install persistent backdoors.

Content

Scanner excerpt · SKILL.md (reported line 53)May include surrounding context.

md

### Common Options

- `-y, --yes` - Skip confirmation prompt
- `-o, --overwrite` - Overwrite existing files
- `-c, --cwd <cwd>` - Set working directory
- `--src-dir` - Use src directory structure

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The description says the skill 'Triggers on shadcn, cva, cn(), data-slot, Radix, Button, Card, Dialog, VariantProps.' Several of these terms, especially 'Button', 'Card', and 'Dialog', are generic UI words that commonly appear outside the intended shadcn/ui context. Without negative examples or tighter scope constraints, the activation description is overly broad for a markdown skill file.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 93% confidence

Finding

The skill recommends executing npx shadcn@latest init, which fetches and runs the latest remote package version at execution time. Because the version is unpinned, future upstream compromise or a malicious release could cause arbitrary code execution on the developer machine or CI environment.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 93% confidence

Finding

npx shadcn@latest add button executes an unpinned package from the registry, creating a supply-chain risk. If the package or account is compromised, users following the skill could run attacker-controlled code without noticing.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 93% confidence

Finding

The example npx shadcn@latest add button card dialog still pulls and runs the latest published package, so it has the same remote-code-execution and supply-chain exposure as the single-component example. The fact that it can modify multiple files increases potential blast radius.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 93% confidence

Finding

npx shadcn@latest add --all combines unpinned remote execution with broad project modification, making compromise especially risky. A malicious or broken upstream release could both execute code and alter a large portion of the repository.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 84% confidence

Finding

Although marked deprecated, the text still references npx shadcn-ui@latest add, which is another unpinned npx execution pattern. Readers may still copy the deprecated command, inheriting the same supply-chain and arbitrary-execution risks.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 93% confidence

Finding

The 'Current' recommended command still uses npx shadcn@latest add, so the active guidance exposes users to unreviewed future package versions. In a skill meant to be copied verbatim, this is a practical supply-chain weakness rather than a theoretical one.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 85% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · SKILL.md (reported line 52)May include surrounding context.

md

### Common Options

- `-y, --yes` - Skip confirmation prompt
- `-o, --overwrite` - Overwrite existing files
- `-c, --cwd <cwd>` - Set working directory
- `--src-dir` - Use src directory structure

Static analysis

No suspicious patterns detected.