frontend-design

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The skill instructs use of the shadcn MCP server which at runtime fetches registry JSON and can execute the shadcn CLI via npx (e.g., https://ui.shadcn.com/r/{name}.json and https://v0.dev/chat/b/{name}), so remote content from those URLs can be fetched and injected into the assistant's context or used to install/execute code.