lab-setup

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The skill fetches the runtime curriculum manifest from https://agency-lab.glebkalinin.com/api/curriculum/.json which directly controls which toolkit entries and install commands the agent will execute, so this external URL can change agent instructions and cause remote-code-install actions.