happyhorse

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (medium risk: 0.30). The skill instructs an install step (npx skills add belt-sh/cli) that fetches and installs remote skill material from a repository whose owner is not established as the first-party publisher of the belt CLI, so it is a common/reputable unofficial dependency (medium), while the other references are documentation or outbound API calls.