agentskills-io

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The repository URL git+https://github.com/agentskills/agentskills#subdirectory=skills-ref is used at runtime (via uv/uvx in scripts and CI) to fetch and execute the remote "skills-ref" tool—which runs code (validation) and can generate agent prompts (e.g., skills-ref to-prompt)—so it is a required external dependency that directly executes remote code and can control prompt output.