shadcn-core-architecture

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.75). The required runtime workflow is the shadcn CLI “add” step, which fetches component source from a registry URL (default https://ui.shadcn.com/registry or a user-configured custom registry URL) and copies it into components/ui/*.tsx, so the LLM context can ingest outsider-authored free text from those fetched registry pages/JSON/code.