shadcn

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.80). The skill explicitly instructs the agent to fetch component documentation and example files at runtime (e.g., URLs returned by npx shadcn@latest docs such as https://ui.shadcn.com/docs/... and example sources like https://raw.githubusercontent.com/...), and those fetched documents are meant to be injected/used to drive how the agent composes prompts and generates code, so remote content directly controls agent behavior at runtime.