nextjs-shadcn — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited nextjs-shadcn (Agent Skill) and scored it 96/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 1 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 1 flagged
The text {match} tells the agent to skip the normal "ask the user first" gate. Used adversarially it removes the human-in-the-loop check before destructive or sensitive actions, turning a normally-gated agent into a fire-and-forget executor.
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Build an interface with a visual identity that fits its content, audience and task. These are design defaults, not a fixed page recipe; the user's direction and an established design system take precedence.
For a new view or substantial redesign, use frontend-design to choose the typography, palette and composition before building. Preserve a working visual system during smaller edits.
Choose fonts for the product's tone, reading density and language support. Use shadcn/create to choose the component style, body and heading fonts, icon family and theme together. Compare the preview with representative content, then make deliberate choices about type scale, spacing and hierarchy. Neither the default preset nor an unusual font guarantees a good design.
Record the chosen preset, theme, fonts and icon family in the project's design notes; preserve that direction unless the brief changes. References and images are project-specific. Component style and icon family are separate choices; styling.md covers them.
Keep the user's task clear:
vercel-react-view-transitions for different animation needs.icons when sourcing new UI icons, file-type icons or official brand assets; an icon does not automatically replace a clear label.Grid and dot patterns, soft background lights, gradients, custom shapes, textures, illustrations and video are available design tools. Use them when they suit the brief, strengthen the product's identity or clarify a section. A distinctive background can be the right choice; a quiet page can be too.
Keep effects behind content, consistent with the palette and proportionate to the page. Use available image or video generation tools when purpose-made media would improve the result, or reuse suitable real assets. Choose the asset and implementation for the task; there is no mandatory animation library or image quota.
Read styling.md when deciding on fonts, theme customization, backgrounds, media or motion.
Use Bun for packages and scripts in new projects: bun install, bun add, bun run <script> and bunx --bun <cli>. This is the user's default; do not ask them to choose a package manager again. In existing projects, follow packageManager, the lockfile, component conventions and configured aliases.
Inspect components.json and the installed components before editing. Use the shadcn skill and the CLI's info/docs commands for project metadata, component documentation and registry guidance.
Component APIs depend on the primitive base (init --base base|radix|aria; Base UI is the default): Base UI uses render where Radix commonly uses asChild. Preserve the existing base and consult its docs.
shadcn docs, add and view need the registry over the network; docs returns URLs rather than text. Offline, the project's own components/ui source and the primitive package's type definitions are the API reference, and shadcn <command> --help, preset decode, migrate --list and the installed shadcn/tailwind.css still work.
Prefer documentation matching the installed Next.js version, including node_modules/next/dist/docs/ when present. Use available Next.js dev tools for runtime errors and route context rather than relying on remembered APIs.
(protected) route group does not enforce authorization.Read architecture.md for routing, Server/Client boundaries and caching; sidebar.md for shared sidebar layouts; project-setup.md for scaffolding and presets.
Inspect the rendered view at relevant mobile and desktop widths. Check composition, wrapping, overflow, controls and the states affected by the change. Preserve accessibility, focus and reduced-motion behavior; screenshots and DOM inspection answer different questions. Own the visual finish: compare the real view and animation intermediates with the project's direction, and fix observed defects before delivery.
Run the project's checks. If @shadcn/lint is configured, use its feedback to keep the design system coherent. For a new Tailwind v4 project, or recurring theme drift, consider integrating it with the existing linter. Configure rules for the intended design; custom backgrounds and media may need deliberate exceptions. See shadcn-platform.md for lint setup and optional shadcn utilities.
Report what changed and what was verified.
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.