Shadcn UI

• Outcome: Pass
• Latest audit: Sep 10, 2026 · 4:36 PM UTC
• Version: 1.0.0

Overview

This is a coherent shadcn/ui guidance skill, but users should treat its copy-paste install commands as normal developer tooling with supply-chain risk.

Install only if you are comfortable with developer tooling that modifies your project. For safer use, pin CLI versions instead of @latest, avoid add --all unless needed, review generated diffs and lockfiles before committing, and run scaffolding without production secrets in the environment.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: README.md:30

Finding

Unpinned Remote Packages and Mutable Sources Executed Through npx

Content

View full analysis

Vulnerability Details

File Location:

• README.md:30
• README.md:36
• SKILL.md:18
• SKILL.md:40-46
• SKILL.md:124
• SKILL.md:443-446
• references/learn.md:59-61
• references/extended-components.md:533-544

Vulnerability Type: Supply-chain exposure through mutable, unverified dependencies
Risk Level: Medium

Vulnerable Code

README.md:30:

bash

npx add https://github.com/wpank/ai/tree/main/skills/frontend/shadcn-ui

README.md:36 and SKILL.md:18:

bash

npx clawhub@latest install shadcn-ui

SKILL.md:40-46:

bash

npx create-next-app@latest my-app --typescript --tailwind --eslint --app
cd my-app
npx shadcn@latest init

# Install components
npx shadcn@latest add button input form card dialog select toast
npx shadcn@latest add --all  # or install everything

SKILL.md:124:

bash

npx shadcn@latest add form input select checkbox textarea

SKILL.md:443-446:

bash

npx shadcn@latest init              # Initialize project
npx shadcn@latest add [component]   # Add specific component
npx shadcn@latest add --all         # Add all components
npx shadcn@latest diff              # Show upstream changes

references/learn.md:59-61:

markdown

- [ ] Run `npx shadcn@latest init`
- [ ] Configure CSS variables
- [ ] Install first component: `npx shadcn@latest add button`

references/extended-components.md:533-544:

bash

npx shadcn@latest init

# Add individual components
npx shadcn@latest add terminal
npx shadcn@latest add dock
npx shadcn@latest add credit-card

# Add multiple components at once
npx shadcn@latest add bar-chart line-chart pie-chart

# Add hooks
npx shadcn@latest add use-boolean use-counter use-local-storage

Technical Analysis

The documentation repeatedly instructs users to execute third-party packages with npx. Several commands explicitly use the mutab ...[truncated 2725 chars]

Remediation

View remediation

Remediation Suggestions

1. Replace every @latest reference with a specifically reviewed package version, for example:

   bash

   npx --yes shadcn@X.Y.Z init
   npx --yes clawhub@X.Y.Z install shadcn-ui
   

2. Pin repository-based installation sources to an immutable Git commit rather than a mutable branch such as main.

3. Verify that all installation URLs refer to the intended official publisher and repository. Avoid personal or unofficial repositories unless they have been independently reviewed and explicitly trusted.

4. Document integrity-verification procedures, such as checking release signatures, package provenance, or published checksums before execution.

5. Commit generated files and lockfiles to version control, then review the complete diff before building or running the resulting application.

6. Prefer installing reviewed CLI versions as development dependencies and invoking the locked local binary instead of downloading a fresh package during each command.

7. Run scaffolding and component-generation tools in a restricted development container or sandbox without production credentials, sensitive environment variables, or unnecessary host filesystem access.

8. Avoid broad operations such as add --all unless all generated components and transitive dependencies are required and reviewed.

SkillSpector

Vulnerability Patterns

• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Rogue Agent: Self-Modification, Session Persistence
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (30)

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 475)May include surrounding context.

md

- [Extended Components](references/extended-components.md) — Terminal, Dock, Charts, animations, custom hooks

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 70% confidence

Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 70% confidence

Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · README.md (reported line 46)May include surrounding context.

From your project root:

bash

mkdir -p .cursor/skills
cp -r ~/.ai-skills/skills/frontend/shadcn-ui .cursor/skills/shadcn-ui

Skill Enumeration

Medium

• Category: Agent Snooping
• Confidence: 85% confidence

Finding

Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Content

Scanner excerpt · README.md (reported line 62)May include surrounding context.

From your project root:

bash

mkdir -p .claude/skills
cp -r ~/.ai-skills/skills/frontend/shadcn-ui .claude/skills/shadcn-ui

Skill Enumeration

Medium

• Category: Agent Snooping
• Confidence: 85% confidence

Finding

Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Content

Scanner excerpt · README.md (reported line 69)May include surrounding context.

Claude Code (global)

bash

mkdir -p ~/.claude/skills
cp -r ~/.ai-skills/skills/frontend/shadcn-ui ~/.claude/skills/shadcn-ui

External Model or Provider Selection

Medium

• Category: Excessive Agency
• Confidence: 90% confidence

Finding

Skill selects an external model or provider that may use a different account or billing plan than the operator expects. Undisclosed model switches can cause unexpected cost or quota consumption.

Content

Scanner excerpt · SKILL.md (reported line 3)May include surrounding context.

md

---
name: shadcn-ui
model: fast
description: Build accessible, customizable UIs with shadcn/ui, Radix UI, and Tailwind CSS. Use when setting up shadcn/ui, installing components, building forms with React Hook Form + Zod, customizing themes, or implementing component patterns.
keywords: [shadcn, shadcn/ui, radix ui, tailwind, react components, forms, react hook form, zod, dialog, sheet, button, card, toast, select, dropdown, table, accessible components]
---

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 92% confidence

Finding

The skill instructs users to run npx clawhub@latest install shadcn-ui, which fetches and executes remote package code at runtime. Even though @latest is specified, it is not pinned to an immutable version and creates a supply-chain risk if the upstream package is compromised or changes unexpectedly.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 89% confidence

Finding

The example uses npx create-next-app@latest, which executes code from the registry without pinning to a specific reviewed release. This exposes users to upstream compromise or behavioral drift over time, especially in automation or repeated setup workflows.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 93% confidence

Finding

The skill tells users to run npx shadcn@latest init, which downloads and runs the latest published CLI code. Because the version is floating, a malicious or compromised upstream release could execute arbitrary code on the developer machine.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 93% confidence

Finding

Using npx shadcn@latest add ... executes an unpinned remote CLI and can introduce arbitrary code execution or unreviewed template changes. In a skill whose purpose is to guide installation, this risk is materially relevant because users are likely to copy-paste the command directly.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 93% confidence

Finding

The npx shadcn@latest add --all command combines unpinned execution with a broad code import action, increasing exposure to malicious or accidental upstream changes. A compromised release could affect many generated components at once.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 91% confidence

Finding

The form setup section again recommends npx shadcn@latest add ..., repeating the same unpinned remote execution pattern. Repetition throughout the skill increases the chance users normalize insecure installation practices.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 92% confidence

Finding

The CLI reference lists npx shadcn@latest init, reinforcing a floating-version execution path from the package registry. Documentation-style skills are high copy-paste surfaces, so even benign examples can propagate risky behavior widely.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 92% confidence

Finding

The CLI reference for npx shadcn@latest add [component] is a true supply-chain risk because it executes whichever release is current at use time. This can lead to arbitrary code execution or unexpected generated code changes.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 92% confidence

Finding

npx shadcn@latest add --all is unpinned and broad in scope, magnifying the blast radius of any compromised or buggy upstream release. It is therefore a legitimate vulnerability pattern in guidance intended for direct execution.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 90% confidence

Finding

npx shadcn@latest diff still runs unpinned remote code, so the issue is not limited to install commands. Any execution of floating registry code creates avoidable supply-chain exposure.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 90% confidence

Finding

The 'NEVER Do' table recommends Use CLI: npx shadcn@latest add, which further institutionalizes the unsafe @latest pattern. Because it is framed as best practice, it may reduce user caution and increase adoption of an insecure workflow.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 94% confidence

Finding

The documentation instructs users to run npx shadcn@latest ..., which fetches and executes code at install time without pinning to a reviewed version. If the upstream package is compromised or a breaking/malicious release is published, users of the skill could execute untrusted code in their development environment.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 94% confidence

Finding

Using npx shadcn@latest add terminal executes the most recent remote CLI code rather than a fixed, audited release. This creates a software supply-chain risk because documentation consumers may run arbitrary newly published code on their machines.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 94% confidence

Finding

The example npx shadcn@latest add dock relies on executing an unpinned package version from the registry. In a developer-tooling context, that can expose workstations and source trees to malicious or compromised package updates.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 94% confidence

Finding

The command npx shadcn@latest add credit-card demonstrates remote code execution from an unpinned release channel. Because npx downloads and runs the package immediately, a compromised publication could lead to arbitrary code execution in the user's environment.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 94% confidence

Finding

The multi-component install example still executes shadcn from @latest, preserving the same supply-chain risk as the other commands. The skill context makes this more dangerous because it is directly actionable setup guidance that developers are likely to copy and run verbatim.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 94% confidence

Finding

The hooks installation example uses npx shadcn@latest, which can cause users to run unaudited code from the newest published package. In documentation for a developer skill, copy-pasteable execution steps materially increase the likelihood of exposure.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 94% confidence

Finding

The guide instructs users to run npx shadcn@latest init, which fetches and executes the latest published package version at runtime rather than a pinned, reviewed version. If the upstream package is compromised or a breaking/malicious release is published, users could execute untrusted code on their systems during setup.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.