shadcn

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.90). The skill explicitly instructs the agent to fetch and read external component documentation and example URLs (SKILL.md and cli.md: "run npx shadcn@latest docs <component> then fetch these URLs" and mcp.md's registry/view tools, plus add accepting arbitrary URLs), so the agent ingests public registry/GitHub/example content that can directly influence install/update/merge decisions and CLI actions.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The skill explicitly tells the agent to fetch component documentation and example source at runtime (e.g. https://ui.shadcn.com and resolved raw GitHub example URLs like https://raw.githubusercontent.com/...) and to inject that fetched content into the agent's context to drive prompts/instructions, so these URLs are runtime dependencies that directly control the agent's behavior.