beui-pro

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.30). The runtime workflow fetches the customer’s beUI Pro registry catalog from https://pro.beui.dev/r/registry.json using the customer’s token and then inspects installed blocks’ generated source/files, so outsider-authored free text from the registry (i.e., item names/descriptions/files) is ingested at runtime.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The skill explicitly fetches the live registry at runtime (e.g., https://pro.beui.dev/r/registry.json) and uses the fetched catalog to decide which packages to inspect/install (and instructs running remote package commands like npx shadcn@latest), so external content fetched during runtime directly controls agent behavior and results in executing remote code.