spark-app-template

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.80). The skill explicitly instructs running pnpm dlx shadcn@latest (e.g., "pnpm dlx shadcn@latest init" / "pnpm dlx shadcn@latest add ..."), which fetches and executes remote code from the shadcn project (https://github.com/shadcn-ui/ui) at runtime and is presented as a required step in the workflow, so this is a high-confidence runtime external dependency that executes remote code.