create-a-project

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (medium risk: 0.30). The installation script fetches external skills from GitHub repositories (mattpocock/skills, DimitriGilbert/ai-skills, and Leonxlnx/taste-skill) using npx -y skills add during setup, introducing common/reputable unofficial operational dependencies.