opendesign-tokens

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (medium risk: 0.30). The skill contains an optional developer CLI script (scripts/bin.mjs) that implements a network-dependent package-resolver (lib/package-resolver.mjs) fetching tarballs from https://registry.npmjs.org, which represents an unverifiable operational external dependency under the dependency gate criteria.