harness

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.85). The skill explicitly instructs running/fetching the external harness-doctor CLI at runtime (e.g. "npx @andypai/harness-doctor@latest --json --verbose" and related package-install commands), which will fetch and execute remote code and is relied on as the canonical deterministic scanner implementation.