shadcn

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.75). The required workflow includes running npx shadcn@latest docs <component> and fetching “the actual content” from resolved URLs (often including raw.githubusercontent.com example code), which is outsider-authored free text/code that can contain prompt-injection payloads.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.80). The skill explicitly instructs the agent at runtime to fetch documentation/examples and registry data (e.g. URLs under https://ui.shadcn.com/, raw.githubusercontent.com/... examples, and https://ui.shadcn.com/r/registries.json) produced by npx shadcn@latest docs/registry commands, so remote content is retrieved during runtime and directly influences the agent's instructions and can include raw code.