YunxiaoQA

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.70). The skill package uses a local Node.js update script (ensure-daily-skill-update.mjs) that executes 'npx skills@latest update' to fetch remote skill updates at runtime, which constitutes an unverifiable runtime external dependency from an unofficial ecosystem source.