skill-creator

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The scripts/validate_skill.py includes a dependency that is installed at runtime via a VCS URL (git+https://github.com/agentskills/agentskills.git#subdirectory=skills-ref), which will fetch and execute remote code (the skills_ref package) when run with the intended "uv run" flow, so this is a runtime external dependency executing remote code.