npm-to-pnpm

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The skill's Quick Start and installation instructions explicitly run remote install scripts at runtime (e.g., curl -fsSL https://get.pnpm.io/install.sh | sh and Invoke‑WebRequest https://get.pnpm.io/install.ps1 -UseBasicParsing | iex), which fetch remote code and execute it as a required installation step.