This report does not block or authorize the manifest or ZIP.
Most static findings are false positives from Markdown examples, JSX template literals, documentation URLs, and reviewed PNG assets. The real residual risk is intentional shadcn CLI execution through package runners, which can fetch registry content and write project files. No prompt-injection attempt or data-exfiltration intent was found.
Report position
Historical report
Open audit history before using this report to install.
Audit attestation
Not attestable
The required immutable binding is incomplete.
Human verification
Not verified
No human verification is recorded for this report.
Coverage
13 Files scanned · 2,460 Lines analyzed
10 items shown for review
Limitations
This report does not claim runtime or sandbox execution and does not prove the absence of side effects.
01
Evidence chain
Follow the evidence from source binding to the install contract. Available evidence supports verification; it is not a safety guarantee.
> **IMPORTANT:** Run all CLI commands using the project's package runner: `npx shadcn@latest`, `pnpm
This line instructs the assistant to execute the shadcn CLI through a package runner. The command is scoped, but it can download code and inspect the project.
This line instructs the assistant to execute the shadcn CLI through a package runner. The command is scoped, but it can download code and inspect the project.
- **Apply preset codes directly with the CLI.** Use `npx shadcn@latest apply <code>` for existing pr
This line instructs the assistant to execute the shadcn CLI through a package runner. The command is scoped, but it can download code and inspect the project.
- **`packageManager`** → use this for any non-shadcn dependency installs (e.g. `pnpm add date-fns` v
This line advises using the project package manager for dependency installs. It may be legitimate, but package installation is a real supply-chain risk.
5. **Install or update** — `npx shadcn@latest add`. When updating existing components, use `--dry-ru
This line instructs use of shadcn CLI commands that can modify project files. The behavior is core to the skill, but it is a real filesystem and supply-chain risk.
- **Overwrite**: `npx shadcn@latest apply <code>`. Overwrites detected components, fonts, and CSS va
This line instructs use of shadcn CLI commands that can modify project files. The behavior is core to the skill, but it is a real filesystem and supply-chain risk.
- **Partial**: `npx shadcn@latest apply <code> --only theme,font`. Updates only the selected preset
This line instructs use of shadcn CLI commands that can modify project files. The behavior is core to the skill, but it is a real filesystem and supply-chain risk.
- **Merge**: `npx shadcn@latest init --preset <code> --force --no-reinstall`, then run `npx shadcn@l
This line instructs use of shadcn CLI commands that can modify project files. The behavior is core to the skill, but it is a real filesystem and supply-chain risk.
- **Skip**: `npx shadcn@latest init --preset <code> --force --no-reinstall`. Only updates config and
This line instructs use of shadcn CLI commands that can modify project files. The behavior is core to the skill, but it is a real filesystem and supply-chain risk.
03
Risk findings
Confirmed security concerns are separated from items that still need review.
The skill allows Bash access to npx shadcn@latest, pnpm dlx shadcn@latest, and bunx shadcn@latest with wildcard arguments. This is core functionality, but it can fetch registry content and modify project files.
The allowed-tools declaration is explicit, and workflow lines later describe add, init, and apply commands. The risk is real but scoped to the shadcn CLI.
04
Remediation
Suggested fixes recorded by this audit. Applying them is the maintainer’s responsibility.
FIX-001
Medium
CLI commands can write project files.
Require explicit user confirmation before add, apply, init, overwrite, or remote registry commands.
FIX-002
Medium
Package runner examples use the latest shadcn CLI.
Pin or document the expected CLI version when reproducible behavior is required.
FIX-003
Medium
Third-party registries can introduce untrusted source code.
Keep dry-run, diff, and post-install file review mandatory before accepting registry changes.
05
Expert evidence
Immutable subject identity, scanner metadata, dismissed matches, and source-level evidence.
Artifact subject
Marketplace commit
Unavailable
Content hash
Unavailable
Tree hash
Unavailable
Skill path
Unavailable
Audit payload hash
Unavailable
Analysis metadata
Audit model: codex
Analysis state: Complete
Scope is limited to the recorded files, lines, methods, and evidence. No runtime or sandbox execution is claimed.