creator-plan-work

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.80). The skill explicitly instructs installing/running remote code at runtime (npm/npx) — e.g., "npx -y @bbengamin/paperclip-mcp-server" and "npm install -g paperclipai" — which fetch and execute external packages used as required runtime fallbacks (MCP/CLI), so they are runtime external dependencies that execute remote code.