Shadcn Ui

• Outcome: Pass
• Latest audit: May 29, 2026 at 8:35 PM UTC
• Version:
  1.0.0

Overview

This is a text-only shadcn/ui frontend guidance skill with no hidden sensitive access or destructive behavior found.

Install if you want shadcn/ui implementation help. Be aware that it may activate on some generic UI terms, and review any suggested `npx` or `npm` command before running it in a project.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (1)

Vague Triggers

Medium

• Confidence: 88% confidence
• Finding: The trigger list contains several generic phrases such as "component library," "UI components," "dialog," "sheet," and "toast" that are not specific to shadcn/ui. In an agent-routing system, these broad triggers can cause the skill to activate for unrelated frontend requests, leading to overbroad scope capture, misrouting, and inappropriate code generation or guidance outside the intended domain.

VirusTotal

64/64 vendors flagged this skill as clean.