when-managing-token-budget-use-token-budget-advisor

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The skill repeatedly runs the runtime command "npx claude-flow@alpha" (invoked for hooks, memory store, and agent spawns), which fetches and executes remote npm package code at runtime that can control agent instructions and is required for the skill to operate.