setup-all

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The skill issues runtime install commands (e.g., "gh skill install mattpocock/skills ...") which fetch remote skill definitions from GitHub that can inject prompts/instructions, and it installs/executes a remote CLI via "npm install -g @fission-ai/openspec@latest", so external content fetched at runtime can directly control agent behavior.