pi-dev-rules

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (medium risk: 0.30). The skill document references installing third-party npm packages via pi install npm:... (e.g., pi-subagents, pi-lens, pi-web-access) at runtime without a verified first-party publisher provenance, matching a common/reputable unofficial operational dependency.