style-authoring

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The skill explicitly instructs fetching and using external runtime content—most notably the schema at https://docs.citum.org/schemas/style.json and parent styles from https://github.com/citum/citum-core/tree/main/styles/ (and even suggests running a remote install script at https://github.com/citum/citum-core/releases/latest/download/install.sh via curl | sh)—and those fetched files are used at runtime to drive validation/template selection (controlling agent behavior) and the install.sh would execute remote code.