searchcli-volcengine-ai-search

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The skill explicitly instructs fetching and executing remote code via git clone git@github.com:volcengine/SearchCLI.git followed by running bash ./scripts/install.sh (and using npx to install directly from that repo), which clearly fetches and executes external repository code as a required install-time dependency.