portaljs-new-portal

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.80). The skill explicitly runs a runtime remote fetch (npx tiged "datopian/portaljs/examples/portaljs-catalog#main") to materialize the template which the skill then installs (npm install) and thus can cause execution of code from the fetched repository.