design-systems

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The skill explicitly instructs runtime fetching and execution of external content (e.g., running the shadcn CLI and fetching docs/examples from https://ui.shadcn.com, raw GitHub URLs like https://raw.githubusercontent.com/..., and even arbitrary example URLs such as https://api.npoint.io/abc123), which would retrieve remote code or documentation that can be injected into the agent's context or executed via npx, so this is a runtime external dependency that can control prompts/execute code.