skill-creator
Warn
Audited by Snyk on Feb 28, 2026
Risk Level: MEDIUM
Full Analysis
MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).
- Potentially malicious external URL detected (high risk: 1.00). The skill explicitly performs runtime WebFetch calls to raw GitHub content (e.g. https://raw.githubusercontent.com/anthropics/skills/main/skills/skill-creator/SKILL.md and the referenced workflows.md and output-patterns.md) whose fetched text is used as upstream guidance that directly shapes skill prompts/instructions, so this is a required external runtime dependency that controls the agent.
Audit Metadata