project-init

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.80). The script runs npx to fetch and execute remote packages at runtime (notably "npx create-next-app@latest" and "npx shadcn@latest"), which downloads and runs code from the npm registry and therefore executes external code during setup.