yy-create-vue3

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.70). The skill's runtime step instructs executing npm install (SKILL.md:129-136) while scripts/.npmrc sets the npm registry to https://registry.npmmirror.com (scripts/.npmrc:2), meaning the agent will fetch remote packages from that registry during runtime which can include install scripts and thus execute remote code.