list-building-tips

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The skill includes the setup command "COLDIQ_API_KEY= npx -y @coldiq/mcp@latest" (SKILL.md:13) which fetches and executes a remote npm package at runtime and the skill relies on the ColdIQ MCP being connected to run mcp__coldiq__* operations, so this is a runtime external dependency that executes remote code.