create-custom-ui-registry

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.80). The skill explicitly relies on and instructs runtime tools to fetch and consume a public registry/catalog URL (e.g. https://.github.io//r/registry.json and the item template https://.github.io//r/{name}.json) (and even suggests cloning https://github.com/shadcn-ui/registry-template), which are fetched at runtime by npx/create-ec-app/shadcn commands and thus directly control what is installed/executed during the workflow.