install-kokonutui-component

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The skill's runtime installation flow relies on fetching component source and registry data from https://kokonutui.com/r/registry.json and https://kokonutui.com/r/{name}.json (and related kokonutui doc URLs), which supplies remote source files that the shadcn CLI downloads and injects into the project (i.e., remote code/content fetched and used at runtime).