shadscanlisted

Audit a React/shadcn app for missing UI fundamentals — accessibility, interaction, empty/error/loading states, form wiring, responsive shell, production polish — with the shadscan CLI, then route each real fix to the dev-flow skill that owns it. The third pre-deploy gate, alongside `compliance-audit` (legal) and `vercel-doctor` (cost); dev-flow proposes it at `feature_complete` and in the `deployed` maintenance loop. Use when the user says "shadscan", "audit my UI", "check accessibility", "is this app accessible", "a11y audit", "missing loading/empty states", "UI quality check", or dev-flow routes here before a web deploy. Refuses for non-React / non-shadcn targets (mobile RN is out of scope). Not for: legal/privacy audit (use compliance-audit), Vercel cost (use vercel-doctor), designing the UI (use design-md-to-app), or writing tests (use write-tests).
lukedj78/dev-flow · ★ 6 · Web & Frontend · score 78

Install: claude install-skill lukedj78/dev-flow

# shadscan — UI-quality & accessibility pre-deploy gate for React/shadcn apps Runs on a web project that **already exists** and uses **shadcn**. It wraps the third-party [shadscan](https://www.shadscan.com/) CLI — a deterministic static audit of *UI fundamentals* — and turns its report into applied fixes, routing each finding to the skill that owns it. This is the gate that covers what neither sibling can see. `compliance-audit` reads the legal surface, `vercel-doctor` reads the cost surface; **nothing in dev-flow mechanically verified that the UI we prescribe actually got built** — that the reduced-motion guard `transitions` mandates is really there, that the form errors `forms` specifies are really rendered, that a route has a loading boundary at all. > **Third-party tool.** shadscan is **not** an official shadcn product — it's an independent open-source > project by [TheOrcDev](https://github.com/TheOrcDev/shadscan), published to npm as **`@shadscan/cli`** > (bin `shadscan`, **MIT**). Verified against the npm registry + repo README (at time of writing: > **0.9.0**, ruleset `2026.07.41`, report `schemaVersion 9` — the report shape is versioned, re-check it). > From the README, verbatim: *"The default scan is deterministic and read-only. It does not start the app, > edit files, call an AI model, upload source, or require application secrets."* That makes it safe to run > on a private codebase without the `--offline` dance `vercel-doctor` needs. ## Verified invocation + f