scaffold-catalog

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.80). The skill instructs running "npx skills add carpenter-singh-lab/catalog-skills --agent claude-code -y", which fetches and installs remote package code at runtime (executing that code and providing the agent's skill logic), so it is a required external runtime dependency that can execute remote code.