taro-shadcn-cli-helper

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.80). The README explicitly instructs installing the skill into an AI assistant via "npx skills add louisyoungx/taro-shadcn" which will fetch and run remote code from the GitHub repo (https://github.com/louisyoungx/taro-shadcn) at runtime to add the skill, so this external repository is a runtime dependency that executes remote code.