shadcn

CRITICAL E005: Suspicious download URL detected in skill instructions.

• Suspicious download URL detected (high risk: 0.70). Three URLs point to third‑party/personal registry or JSON hosting endpoints (api.npoint.io, private.com, acme.com) that the CLI can fetch and which could deliver arbitrary code/registry data — these are higher risk than the official ui.shadcn.com and raw.githubusercontent.com example URLs.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The skill explicitly instructs agents to fetch component docs, presets, and registry JSON from external URLs at runtime (e.g. https://ui.shadcn.com and example URLs like https://raw.githubusercontent.com/.../examples/input-example.tsx and https://api.npoint.io/abc123), meaning remote content directly informs/controls the agent's output and is required for operation.