pypi-security-best-practices

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The skill contains installation commands that fetch and immediately execute remote scripts at runtime (e.g., curl -LsSf https://astral.sh/uv/install.sh | sh, powershell -c "irm https://astral.sh/uv/install.ps1 | iex", curl -sSL https://sh.phylum.io/ | sh, and curl -Ls https://cli.doppler.com/install.sh | sh), so these URLs are runtime external dependencies that execute remote code.