mcp-setup

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The skill includes a runtime instruction to pull/run a remote Docker image (docker pull ghcr.io/github/github-mcp-server:0.30.2), which fetches and executes remote code the MCP server depends on, so this is a runtime external dependency that can execute code.