firebase-firestore

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.80). The skill invokes npx to fetch-and-run the remote npm package (e.g., "npx -y firebase-tools@latest firestore:databases:list") at runtime and also instructs the agent to fetch dependency/version info from https://firebase.google.com/support/release-notes/android, so it clearly relies on remote content that is executed or influences runtime behavior.