skill-guide

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The guide explicitly instructs runtime installation via commands like "npx skills add https://github.com/..." (and owner/repo shorthands), which fetch remote GitHub repositories whose SKILL.md and bundled scripts can directly control agent prompts or execute code, making that GitHub URL pattern a runtime dependency risk.