skill-publish-sync

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.70). The script fetches a remote installation archive via curl from skillhub-1388575217.cos.ap-guangzhou.myqcloud.com during the setup instructions and executes it, which constitutes an unverified external runtime dependency with weak provenance.