shadcn-ui

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 1.00). The skill includes CLI/runtime commands that fetch and install remote registry/component JSONs (e.g., "npx shadcn add https://acme.com/registry/navbar.json" and registry endpoints like https://ui.shadcn.com/r/{name}.json, https://example.com/r/button.json, and http://localhost:3000/r/hello-world.json) which are fetched at runtime and can deliver/execute code or install files that directly control what is injected into the project, so this is a high-risk runtime external dependency.