autosync-ic-skills

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The SessionStart hook's sync script fetches and installs remote skills at runtime from https://skills.internetcomputer.org/.well-known/skills (notably https://skills.internetcomputer.org/.well-known/skills/index.json and the sync script URL https://skills.internetcomputer.org/.well-known/skills/autosync-ic-skills/scripts/sync-ic-skills.sh), and those fetched skill files directly control agent prompts/behavior and can contain executable code the agent will load and run.