shadcn

CRITICAL E005: Suspicious download URL detected in skill instructions.

• Suspicious download URL detected (high risk: 0.70). Several URLs point to non-official, user-controlled registry/JSON hosting endpoints (private.com, api.npoint.io, acme.com, example.com) that could deliver arbitrary files or registry payloads and are therefore higher-risk for malware distribution, while ui.shadcn.com and raw.githubusercontent.com are official/standard documentation/code hosts and are lower risk.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.75). The required workflow instructs the agent to run npx shadcn@latest docs <component> and “fetch the URLs” (and also view/add from registries), which at runtime can ingest outsider-authored free text/code from public web/registry sources into the LLM context.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The skill explicitly instructs the agent to fetch external component/docs/registry URLs at runtime (e.g. https://ui.shadcn.com/docs/components/radix/input, https://raw.githubusercontent.com/.../examples/input-example.tsx, https://api.npoint.io/abc123, and https://ui.shadcn.com/r/registries.json), and that fetched content is used to drive component creation/installation and agent behavior, so this is a runtime external dependency that can control prompts or actions.