static-qr-code-generation

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.70). The skill's runtime instructs installing and running the remote npm package (npm install qrcode && node -e "require('qrcode'...)"), which fetches and executes code from the qrcode package (https://www.npmjs.com/package/qrcode), so the skill relies on and runs external code at runtime.