shadcn

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.75). The required runtime workflow includes fetching component documentation/examples via npx shadcn@latest docs <component> and then “fetch the URLs to get the actual content,” which can ingest outsider-authored free text from public web sources (e.g., ui.shadcn.com docs pages and raw GitHub example files) into the agent’s LLM context.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.80). The skill explicitly instructs the CLI/agent to fetch remote docs, examples, presets and registry JSONs at runtime (e.g. https://ui.shadcn.com/docs/..., https://raw.githubusercontent.com/..., https://api.npoint.io/abc123, https://ui.shadcn.com/init?... and registry URLs like https://ui.shadcn.com/r/registries.json or https://acme.com/r/{name}.json), and those fetched files can contain component source or preset configuration that directly determines what the agent installs or advises—i.e., external content is fetched at runtime and can control agent actions or the code added to the project.