git-worktrees

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.80). Step 3/5 ("Install dependencies") runs package managers (npm install → https://registry.npmjs.org, pip install → https://pypi.org, bundle install → https://rubygems.org) which will fetch and execute remote packages at runtime, so the skill has runtime external dependencies that execute remote code.