shadcn-impl-component-install

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 1.00). The CLI fetches registry JSON at runtime (e.g., https://ui.shadcn.com/r/{name}.json and the explicit remote example https://example.com/r/x.json or custom registry URLs like https://registry.myorg.com/{name}.json), and the returned JSON is used to write component source and to drive npm installs declared by the item—allowing remote content to control what code is written and to trigger installation/execution of remote packages.