second-opinions

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.80). The skill explicitly instructs installing Gemini extensions at runtime using commands like "gemini extensions install https://github.com/gemini-cli-extensions/code-review" and "https://github.com/gemini-cli-extensions/security", which fetch and execute remote code that can alter agent behavior and are presented as required dependencies for certain Gemini features.