web-artifacts-builder

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The build/init scripts run package-manager commands that fetch and execute remote packages at runtime (e.g., "pnpm create vite" and "pnpm dlx shadcn@latest" which pull and execute code from the npm registry https://registry.npmjs.org), so the skill relies on executing remote code fetched during runtime.