stream-builder

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.80). The skill runs npx shadcn@latest (the shadcn scaffolder) at runtime, which fetches and executes remote code from the shadcn repo (https://github.com/shadcn-ui/ui) as a required part of the scaffold flow, so this external URL is a runtime-executed dependency.