building-react-native-application

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.90). Yes — the script scripts/add-registry-component.js (and the referenced adding-registry-components.md flow) calls shadcn view to fetch registry-item JSON from arbitrary registry URLs (defaulting to https://reactnativereusables.com/r/nativewind/...), parses that untrusted third‑party content, writes files into src/ui/, appends CSS vars, and installs declared dependencies, meaning the agent ingests and acts on external user-generated/open-web content that can materially influence tool use.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The included script scripts/add-registry-component.js invokes shadcn (via npx/pnpm/bunx) to fetch registry JSON at runtime from URLs under https://reactnativereusables.com/r/nativewind/ (e.g. "https://reactnativereusables.com/r/nativewind/button.json"), parses that remote content to write source files into the project and installs dependencies—meaning remote content directly controls code written/executed by the tool.