cargo-cdk

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.80). The docs instruct fetching/installing remote cookbooks at runtime (e.g. npx skills add getcargohq/gtm-skills/tam-building), which pulls content from https://github.com/getcargohq/gtm-skills that the agent then reads (.agents/skills/<slug>/SKILL.md) and uses as procedural instructions, so remote content can control prompts/instructions at runtime.