adding-a-skill

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The skill framework explicitly materializes the remote repo "BuilderIO/skills" at runtime (discovering and loading skills/*/SKILL.md which directly control agent instructions), and the README also instructs running "npx @agent-native/skills@latest" which fetches and executes remote npm package code—so remote content can be fetched at runtime and directly control prompts/execution.