shadcn

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (low risk: 0.10). The shadcn/ui workflow ingests only the user’s explicit natural-language prompt (e.g., the requested UI spec) and the user’s own project context, while “registry items” content is fetched only after the agent selects specific components/presets to add (and is not automatically processed from arbitrary outsider-authored free text sources).

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The skill explicitly instructs the agent at runtime to fetch external component docs and registry JSONs (e.g., https://ui.shadcn.com/init?base=radix&style=nova&..., https://api.npoint.io/abc123, https://acme.com/r/{name}.json) whose content is fetched and used to guide the agent's code/response generation, so these runtime fetches can directly control prompts.