shadcn-core-architecture

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The skill explicitly instructs the CLI to fetch component source from a remote registry at runtime (e.g. the default registry https://ui.shadcn.com/registry and example registry URLs like https://registry.acme.example.com/{name}.json or https://partner.example.com/registry / https://internal.example.com/registry/button.json), and those fetched JSON/source files are used to write/replace component code (remote code being brought into and executed/used in the consumer project), so this is a runtime external dependency that delivers remote executable code.