ponytail

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.80). The Claude Desktop MCP config runs an npx command that will fetch-and-execute the remote repo to serve the skill at runtime — e.g. "npx skills serve https://github.com/akillness/oh-my-skills --skill ponytail" (https://github.com/akillness/oh-my-skills) — so that URL is used at runtime to load code that controls agent prompts.