garmin-connect

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 1.00). The README and installer scripts instruct running curl -fsSL ... | sh (e.g. https://raw.githubusercontent.com/eddmann/garmin-connect-cli/main/install-skill.sh and https://raw.githubusercontent.com/eddmann/garmin-connect-cli/main/install.sh), and install-skill.sh fetches https://raw.githubusercontent.com/eddmann/garmin-connect-cli/main/SKILL.md at install time which is then placed into agent skill directories — this fetch+execute flow installs remote content (the SKILL.md) that directly controls agent prompts/instructions.