task-tracking-dots

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The skill's Preflight instructs cloning and building the external repo https://github.com/joelreymont/dots.git (git clone ... then zig build), which fetches remote source and runs build steps to install the required dot CLI, meaning remote code would be fetched and executed as a required dependency.