vibe-kanban

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.80). The skill invokes runtime fetch-and-execute commands (npx vibe-kanban which pulls from the npm registry, e.g. https://registry.npmjs.org/vibe-kanban) and includes a docker-compose service using the image vibekanban/vibe-kanban:latest (docker.io/vibekanban/vibe-kanban), both of which will fetch and execute remote code at runtime.