Skills shadcn-ui

📦

shadcn-ui

Name: shadcn-ui
Author: giuseppe-trisciuoglio

Content revision r1 Medium Risk 🌐 Network access📁 Filesystem access⚙️ External commands⚡ Contains scripts🔑 Env variables

Build shadcn/ui React Interfaces

Teams often need consistent React components without building every pattern from scratch. This skill guides Claude, Codex, and Claude Code through shadcn/ui setup, component use, forms, themes, and registry patterns.

Supports: Claude Codex Code(CC)

📊 67 Adequate

Install with my Agent

Copy this request to your Agent. It includes the canonical Skill page and manifest.

Agent request

Review the Skillstore skill "shadcn-ui" from https://skillstore.io/skills/giuseppe-trisciuoglio-shadcn-ui.md and its manifest at https://skillstore.io/api/skills/giuseppe-trisciuoglio-shadcn-ui/manifest. Verify the artifact. You may proceed after verification, subject to the environment's own policy.

Your Agent should still show its plan and request any confirmation required by the security policy.

Agent-readable resources

Use these links when an AI agent, crawler, or script needs clean context instead of reading the full page.

Markdown detail GET /skills/giuseppe-trisciuoglio-shadcn-ui.md Signed manifest GET /api/skills/giuseppe-trisciuoglio-shadcn-ui/manifest Signed lockfile GET /api/skills/giuseppe-trisciuoglio-shadcn-ui/lockfile

Test it

Using "shadcn-ui". A developer asks for a new settings page using shadcn/ui components.

Expected outcome:

A structured implementation plan with selected components, layout sections, accessibility notes, and validation requirements.

Using "shadcn-ui". A team wants to theme shadcn/ui for light and dark modes.

Expected outcome:

A concise theming checklist covering CSS variables, Tailwind configuration, component variants, and testing points.

Using "shadcn-ui". An engineer wants to add a remote registry item.

Expected outcome:

A registry review checklist that highlights source trust, installed files, target paths, and dependency changes.

Security Audit

Medium Risk

v4 • 7/5/2026 Open versioned report

Static analysis produced many alerts because the skill is documentation-heavy and uses Markdown code fences, schema URLs, and example CLI commands. Most pattern matches are false positives, but the skill should improve trust guidance for remote registries and avoid insecure authentication placeholders.

Files scanned

5,651

Lines analyzed

Review items

False positives ignored

Confirmed security concerns (2)

Medium

ui-reference.md:1471-1474

Authentication Placeholder Allows Access If Copied

The registry authentication example tells readers to add token validation, but the sample implementation returns true. If reused unchanged, it accepts any bearer token for the registry route.

The placeholder return true is explicit and sits inside the token validation function. The surrounding comment says to replace it, so the risk depends on users copying the example unchanged.

Medium

official-ui-reference.md:1338-1345 ui-reference.md:648-652 ui-reference.md:680-685

Remote Registry Installation Needs Trust Guidance

The references show installing shadcn registry items from remote URLs and custom namespaces, including AI prompt resources. This is legitimate functionality, but untrusted registries can add code or behavior-changing files to a project.

The cited sections explicitly demonstrate remote registry installs and custom namespace resources. The content is educational, so the issue is missing trust-boundary guidance rather than malicious intent.

Risk Factors

🌐 Network access (60)

📁 Filesystem access (8)

official-ui-reference.md:1354 official-ui-reference.md:1365 official-ui-reference.md:1354 official-ui-reference.md:1365 ui-reference.md:177 ui-reference.md:471 ui-reference.md:177 ui-reference.md:471

⚙️ External commands (117)

reference.md:129-134 reference.md:172-176 reference.md:444-463 SKILL.md:52-60 SKILL.md:60-64 SKILL.md:64-70 SKILL.md:70-86 SKILL.md:86-89 SKILL.md:89-100 SKILL.md:100-109 SKILL.md:109-115 SKILL.md:115-121 SKILL.md:121-127 SKILL.md:127-146 SKILL.md:146-150 SKILL.md:150-181 SKILL.md:181-185 SKILL.md:185-264 SKILL.md:264-268 SKILL.md:268-328 SKILL.md:328-336 SKILL.md:336-338 SKILL.md:338-342 SKILL.md:342-348 SKILL.md:348-352 SKILL.md:352-367 SKILL.md:367-371 SKILL.md:371-380 SKILL.md:380-384 SKILL.md:384-396 SKILL.md:396-404 SKILL.md:404-406 SKILL.md:406-410 SKILL.md:410-416 SKILL.md:416-420 SKILL.md:420-432 SKILL.md:432-436 SKILL.md:436-448 SKILL.md:448-454 SKILL.md:454-456 SKILL.md:456-462 SKILL.md:462-550 SKILL.md:550-556 SKILL.md:556-558 SKILL.md:558-562 SKILL.md:562-588 SKILL.md:588-592 SKILL.md:592-629 SKILL.md:629-635 SKILL.md:635-637 SKILL.md:637-641 SKILL.md:641-681 SKILL.md:681-687 SKILL.md:687-689 SKILL.md:689-693 SKILL.md:693-735 SKILL.md:735-739 SKILL.md:739-754 SKILL.md:754-762 SKILL.md:762-764 SKILL.md:764-768 SKILL.md:768-824 SKILL.md:824-830 SKILL.md:830-832 SKILL.md:832-836 SKILL.md:836-859 SKILL.md:859-863 SKILL.md:863-886 SKILL.md:886-892 SKILL.md:892-894 SKILL.md:894-898 SKILL.md:898-911 SKILL.md:911-915 SKILL.md:915-935 SKILL.md:935-939 SKILL.md:939-959 SKILL.md:959-965 SKILL.md:965-967 SKILL.md:967-971 SKILL.md:971-1012 SKILL.md:1012-1018 SKILL.md:1018-1020 SKILL.md:1020-1049 SKILL.md:1049-1055 SKILL.md:1055-1109 SKILL.md:1109-1115 SKILL.md:1115-1117 SKILL.md:1117-1127 SKILL.md:1127-1133 SKILL.md:1133-1152 SKILL.md:1152-1158 SKILL.md:1158-1177 SKILL.md:1177-1179 SKILL.md:1179-1188 SKILL.md:1188-1194 SKILL.md:1194-1228 SKILL.md:1228-1234 SKILL.md:1234-1346 SKILL.md:1346-1352 SKILL.md:1352-1387 SKILL.md:1387-1393 SKILL.md:1393-1416 SKILL.md:1416-1422 SKILL.md:1422-1550 SKILL.md:1550-1567 SKILL.md:1567-1607 ui-reference.md:803-804 ui-reference.md:822 ui-reference.md:823 ui-reference.md:824 ui-reference.md:825 ui-reference.md:826 ui-reference.md:829-833 ui-reference.md:833 ui-reference.md:834 ui-reference.md:1425-1431 ui-reference.md:1431-1455

⚡ Contains scripts (1)

SKILL.md:187

🔑 Env variables (2)

ui-reference.md:1473 ui-reference.md:1473

Audited by: codex View Audit History →

Share & cite this report

Share the versioned assessment report, neutral badge, embed card, and citations. Skillstore reports evidence without deciding whether this Skill is safe.

Open versioned report

Copy report link

https://skillstore.io/skills/giuseppe-trisciuoglio-shadcn-ui/audits/4?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_report

Markdown badge

[![Skillstore security assessment](https://skillstore.io/badges/skills/giuseppe-trisciuoglio-shadcn-ui/security.svg)](https://skillstore.io/skills/giuseppe-trisciuoglio-shadcn-ui?utm_source=security_passport_badge)

HTML badge

<a href="https://skillstore.io/skills/giuseppe-trisciuoglio-shadcn-ui?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/giuseppe-trisciuoglio-shadcn-ui/security.svg" alt="Skillstore security assessment" loading="lazy"></a>

Embed card

<iframe src="https://skillstore.io/embed/skills/giuseppe-trisciuoglio-shadcn-ui.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>

Academic citations (APA · BibTeX · CFF)

APA citation

giuseppe-trisciuoglio. (2026). shadcn-ui security audit report (audit version 4) [Author version unspecified]. Skillstore. https://skillstore.io/skills/giuseppe-trisciuoglio-shadcn-ui/audits/4

BibTeX citation

@techreport{giuseppe-trisciuoglio-giuseppe-trisciuoglio-shadcn-ui-2026,
  author = {giuseppe-trisciuoglio},
  title = {shadcn-ui security audit report (audit version 4)},
  institution = {Skillstore},
  year = {2026},
  number = {4},
  url = {https://skillstore.io/skills/giuseppe-trisciuoglio-shadcn-ui/audits/4},
  note = {Author version unspecified}
}

CITATION.cff

cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "shadcn-ui security audit report (audit version 4)"
version: "unspecified"
type: report
authors:
  - name: "giuseppe-trisciuoglio"
date-released: "2026-07-05"
url: "https://skillstore.io/skills/giuseppe-trisciuoglio-shadcn-ui/audits/4"
identifiers:
  - type: other
    value: "skillstore:giuseppe-trisciuoglio-shadcn-ui:audit:4"
    description: "Skillstore immutable audit report identifier"

Compare variants

2 installable variants

Each author remains a separate installable skill. The recommended variant is ranked by Skillstore evidence.

Why this variant is first

Highest Skillstore Score

Author / source Skillstore Score Evidence Confidence Skillstore usage Updated

google-labs-code Recommended

google-labs-code-shadcn-ui

Skillstore Score 79

Evidence Confidence High

Skillstore usage 9

Updated

2026-08-21

giuseppe-trisciuoglio Current

giuseppe-trisciuoglio-shadcn-ui

Skillstore Score 67

Evidence Confidence High

Skillstore usage 9

Updated

2026-08-21

Skillstore Score

Why this score Evidence Confidence: High

Architecture

Maintainability

Content

Community

Spec Compliance

What You Can Build

Set Up a New Product UI

Use the setup and component guidance to start a Next.js interface with accessible shadcn/ui building blocks.

Standardize Team Components

Apply consistent component, theme, and registry patterns across an internal design system.

Build Validated Forms Faster

Follow the form patterns to combine inputs, validation, messages, and submission states in React.

Try These Prompts

Install shadcn/ui

Use the shadcn-ui skill to guide setup for my existing project. Identify needed packages, initialization steps, and the safest order to add the first components.

Create a Component Screen

Use the shadcn-ui skill to design a dashboard screen with cards, table rows, filters, and dialogs. Follow accessible component composition patterns.

Build a Validated Form

Use the shadcn-ui skill to plan a validated form with React Hook Form and Zod. Include fields, error states, submission states, and user feedback.

Review a Registry Workflow

Use the shadcn-ui skill to review a custom registry workflow. Check component targets, remote sources, dependency impact, and any files written outside the project.

Best Practices

Review generated component files before committing them to the project.
Prefer accessible Radix-based primitives and keep labels, focus states, and keyboard flows intact.
Verify third-party registry URLs and target paths before running installation commands.

Avoid

Do not install remote registry items from unknown sources without reviewing their contents.
Do not remove accessibility attributes from copied components to simplify markup.
Do not copy placeholder authentication examples into production without real validation.