shadcn-ui

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.80). The skill instructs running the remote CLI via commands like "pnpm dlx shadcn@latest info --json" and "pnpm dlx shadcn@latest add ", which fetch and execute code from the npm registry at runtime and thus can execute remote code that affects agent behavior.