oh-my-claudecode-multi-agent-orchestration

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The skill’s installation commands fetch and install remote code that will run in the agent environment (e.g., /plugin marketplace add https://github.com/Yeachan-Heo/oh-my-claudecode and npm i -g oh-my-claude-sisyphus@latest which pulls from the npm registry), so the GitHub/npm-hosted content is a runtime external dependency that can execute code and control agent behavior.