kao-shadcn-base-ui

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.85). The skill's documentation and references (e.g., references/ui-reference.md and SKILL.md) instruct using the shadcn CLI to fetch/install remote registry items and arbitrary URLs (for example "npx shadcn add https://acme.com/registry/navbar.json" and components.json registry entries), which means it will fetch untrusted, user-provided web content that the tool ingests and uses to modify project files and behavior.