shadcn-errors-cmdk-version-drift

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.80). The skill contains explicit runtime commands that fetch and run external content — e.g. curling https://ui.shadcn.com/r/styles/new-york/command.json at runtime and instructing users to run "pnpm dlx shadcn@latest add command --overwrite" which fetches and executes the shadcn package from the npm registry — so it relies on remote content that can execute code.