21st-cli

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 0.90). The skill explicitly instructs passing API keys on the command line via --api-key <key> (and notes publish requires a 21st_sk_… key), which encourages embedding secret values verbatim in generated commands or outputs and therefore creates exfiltration risk.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.75). The required workflow is installing/using the 21st CLI/skill, which at runtime fetches registry items (e.g., component code/demos and theme/template content) from 21st.dev/public registries; that fetched outsider-authored free text (code/HTML/CSS/metadata) is then ingested into the agent context to display/print/install.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The doc shows a runtime fetch that installs remote code — e.g. npx shadcn@latest add "https://21st.dev/r/<user>/<slug>" (SKILL.md:53) — which downloads component code and triggers installing npm deps, i.e., fetching and executing remote content at runtime.