shadcn-ui

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The skill includes commands and registry examples that fetch and execute remote component registries (e.g., npx shadcn@latest add https://acme.com/registry/navbar.json and use of https://ui.shadcn.com), meaning external URLs are used at runtime to retrieve and install/execute code that controls what is installed.