premium-ui-components

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.70). This skill's SKILL.md explicitly instructs pulling components from public registries (e.g., https://magicui.design, https://ui.aceternity.com, and the community 21st.dev) and to "open the component page / copy the source," so the workflow fetches and reads untrusted third‑party/user‑generated content that could influence integration decisions.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.80). The skill's install instructions tell users to run npx shadcn@latest add with remote registry URLs (e.g., "https://magicui.design/r/", "https://ui.aceternity.com/registry/.json", and "https://21st.dev/r//"), which fetch component source and invoke remote CLI code at install/runtime so external content can execute code and is relied on as a required dependency.