ast-grep

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The skill's installers and README direct fetching and installing remote code (e.g., git clone https://github.com/code-yeongyu/ast-grep-skill and the GitHub release download used in install.sh / install.ps1: https://github.com/ast-grep/ast-grep/releases/download/${VERSION}/ast-grep-.zip), and the install scripts explicitly download (curl/Invoke-WebRequest) and install binaries that the helper then executes—so remote content is fetched at runtime and executed as a required dependency.