when-creating-slash-commands-use-slash-command-encoder

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The skill repeatedly invokes "npx claude-flow@alpha", which at runtime fetches and executes remote npm package code that the workflow depends on (npx will download and run the claude-flow package), so there is runtime external code execution via that external dependency.