shadcn-registry
Warn
Audited by Snyk on Mar 3, 2026
Risk Level: MEDIUM
Full Analysis
MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).
- Third-party content exposure detected (high risk: 0.70). The skill's required workflow explicitly allows and documents using arbitrary external registry URLs (e.g., "registryDependencies" can be full URLs in Step 5/Step 6 and installation via "npx shadcn@latest add https://your-domain.com/r/component-name.json" in Step 8), meaning the system will consume untrusted public JSON from third-party sites that can influence installs and build behavior.
Audit Metadata