bootstrap

The instruction's sink is executing whatever the mutable @latest tag of the shadcn CLI resolves to at runtime, which is not a pinned official-registry install, and no declared claim covers external CLI execution (D8 even confines runs to scripts that exist in package.json), so no carve-out, declaration, or mitigation kills the finding. The locator says line 152 while the quote sits at line 153 of the cited unit; a one-line offset does not falsify the claim.

Same instruction and evidence as the line-152 finding, with the locator correctly matching line 153 where the npx shadcn@latest command actually appears; unpinned @latest execution falls outside the pinned official-registry-install carve-out and outside every declared claim (D8-D12), so the finding survives.

The strongest case against the finding is that the pointer is openly visible and targets a sibling in-repo guide, but that fails: the NOT CONSUMED result confirms the pointer's target sits outside every discovered skill/plugin/MCP surface, so an agent following it ingests runtime content that was never reviewed; no carve-out, declared claim (D9-D12 or the description), or mitigation neutralizes the directive.