Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add clubpay/ronykit --skill shadcngit clone --depth 1 https://github.com/clubpay/ronykitWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/clubpay/ronykit/shadcn)<a href="https://agentmods.dev/skills/clubpay/ronykit/shadcn"><img src="https://agentmods.dev/badge/skills/clubpay/ronykit/shadcn.svg" alt="Measured on agentmods" height="20"></a>- NVIDIA SkillSpector warn
SkillSpector: 9 findings, up to medium
These are SkillSpector’s own severities. On a checked sample its high-severity flags on skills were ~96% false positives — a documented command, a public API, a “never do X” rule — so we show them as a caution to read, not a verdict. Why →
- medium MCP Rug Pull · line 28 npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.Fix: Pin the version: npx @scope/[email protected]
- medium MCP Rug Pull · line 37 npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.Fix: Pin the version: npx @scope/[email protected]
- medium MCP Rug Pull · line 40 npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.Fix: Pin the version: npx @scope/[email protected]
- medium MCP Rug Pull · line 41 npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.Fix: Pin the version: npx @scope/[email protected]
- medium MCP Rug Pull · line 42 npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.Fix: Pin the version: npx @scope/[email protected]
- medium MCP Rug Pull · line 43 npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.Fix: Pin the version: npx @scope/[email protected]
- medium MCP Rug Pull · line 44 npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.Fix: Pin the version: npx @scope/[email protected]
- medium MCP Rug Pull · line 45 npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.Fix: Pin the version: npx @scope/[email protected]
- medium MCP Rug Pull · line 46 npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.Fix: Pin the version: npx @scope/[email protected]
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00059 | $0.01096 |
| Opus 5 | $0.00030 | $0.00548 |
| Sonnet 5 | $0.00012 | $0.00219 |
| Haiku 4.5 | $0.00006 | $0.00110 |
Grade A, and why
shadcn scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 8d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 105 lines — stays where its author put it; the contents beside it link to each section on GitHub.
shadcn/ui
shadcn/ui components are copied into your project (not a dependency) and composed from primitives. Always discover the real component API before generating code — don't guess prop names.
When to use
- Adding or composing UI components, forms, dialogs, tables, dashboards.
- Theming (CSS variables, dark mode, radius, colors) or adding from a registry.
- Reviewing frontend work that uses shadcn/ui.
Get the live, project-aware skill (recommended)
The official skill reads your project and injects accurate context. Install it and enable the shadcn MCP so the assistant uses real component data:
npx skills add shadcn/ui # installs the official shadcn skill
When present, it activates on a components.json and runs shadcn info --json
to learn your framework, Tailwind version, aliases, base library (radix or
base), icon library, and installed components. Prefer this over memory.
CLI workflow
Use the CLI (npx shadcn@latest …) — never hand-copy component source:
npx shadcn@latest init # set up components.json + base styles
npx shadcn@latest search <query> # find components in the registry
npx shadcn@latest view <name> # inspect a component's files/API
npx shadcn@latest docs <name> # read its documentation
npx shadcn@latest add <name> # install a component (and its deps)
npx shadcn@latest info --json # current project configuration
npx shadcn@latest diff # see upstream changes to installed components
Discover with search/view/docs (or the MCP tools) before writing code,
so you use the correct, version-specific API on the first try.
Composition rules
- Compose from shadcn primitives instead of raw HTML where one exists.
- Forms: use
Field/FieldGroup(and the form primitives) for layout and labelling, not ad-hocdivs. - Option sets:
ToggleGroup/RadioGrouprather than hand-rolled buttons. - Respect the base library's API (
radixvsbase) — they differ; check first. - Keep generated component files editable in your repo; customize there.
What ships with it
2 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 8d ago First seen · 105 lines · 59 tokens per session scan A f5853f8161ca
shadcn is a skill published in the GitHub repository clubpay/ronykit (38 stars, last pushed yesterday), licensed BSD-3-Clause. It adds 59 tokens to every session and 1,096 once invoked, about $0.0003 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
multitenant
Multi-tenant / multitenancy patterns in Vovk.ts — hosting multiple tenants from one Next.js app via subdomain routing. Covers the multitenant() helper from vovk, the Next.js proxy.ts file that wires it up, the overrides shape (static / dynamic / nested subdomain patterns), the vovk.config.mjs changes needed (switch to…
writing-clearly-and-concisely
Apply whenever writing content a human will read — emails, documents, reports, documentation, messages, UI copy, commit messages, explanations, or any other prose. Applies Strunk's timeless rules for clearer, stronger, more professional writing.
gentleman-bubbletea
Bubbletea TUI patterns for Gentleman.Dots installer. Trigger: When editing Go files in installer/internal/tui/, working on TUI screens, or adding new UI features.
remotion-animation
Generates animation configurations for Remotion including spring configs, interpolations, easing functions, and timing logic. Focuses ONLY on animation parameters, NOT component implementation. Use when defining animation behavior or when asked to "configure animations", "setup spring configs", "define easing curves".
create-remotion-geist
Create Remotion videos using the Geist design system aesthetic. Use when asked to create videos, animations, or motion graphics that should follow Vercel's visual style - dark theme, spring animations, Geist typography, and the Geist color palette.
ast-introspection
Use Go AST-aware analysis to enumerate symbols, extract signatures, and propose mechanically safe refactors (read-only by default).