gm-skill

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 1.00). The skill instructs booting an external package at runtime via "bun x gm-plugkit@latest spool" (or "npx -y gm-plugkit@latest spool"), which fetches and executes remote code that serves the plugkit instruction stream and thus can directly control prompts/instructions, so this is a required runtime dependency that executes fetched code.