openspec-install

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.80). The skill directs runtime installation that fetches and executes remote code (e.g., "nix run github:Fission-AI/OpenSpec" and "npm install -g @fission-ai/openspec@latest", which pull from https://github.com/Fission-AI/OpenSpec and the npm registry), so external content is used at runtime to install/execute code.