Recommends installing and executing unpinned third-party packages
Source references: 4The Skill requires emitting an install command when a dependency is missing and includes `npx shadcn@latest` plus multiple npm and yarn commands. `@latest` is not version-pinned and downloads and executes whatever is current; package installation can also run third-party lifecycle scripts.
If the user or agent executes these commands, project dependencies and files may change. A compromised upstream package, breaking release, or mistaken package choice could execute third-party code with the permissions of the developer machine or CI job.
The Skill mandates an install command for missing dependencies and supplies `npx shadcn@latest` commands that download, execute, and write into the project. `@latest` is explicitly unpinned, and other installs are also unpinned; execution may invoke third-party lifecycle scripts. The user can require exact versions, a lockfile, and review of packages and write scope before running.
### 3.F Dependency Verification (mandatory)Before importing ANY 3rd-party library, check `package.json`. If the package is missing, output the install command first. **Never** assume a library exists.Show 3 other places
# Radix Themesnpm install @radix-ui/themes# shadcn/ui (open code, owned components)npx shadcn@latest initnpx shadcn@latest add button card badge separator input# Atlassian Design System (Atlaskit)yarn add @atlaskit/css-reset @atlaskit/tokens @atlaskit/button @atlaskit/badge @atlaskit/section-message @atlaskit/card# Bootstrap 5.3npm install bootstrap# shadcn/ui (open code, owned components)npx shadcn@latest initnpx shadcn@latest add button card badge separator input