setup-xhs-mcp

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The skill explicitly downloads and runs a docker-compose file from https://raw.githubusercontent.com/xpzouying/xiaohongshu-mcp/main/docker/docker-compose.yml (wget ... then docker compose up -d), which at runtime causes remote container images to be pulled and executed, so this URL is a runtime external dependency that can execute remote code.