sync-skill-repo

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.80). The skill's runtime invokes the system package runner (pnpm dlx) to "skills add"/"skills update" with repository sources such as "Hu-Wentao/skills" (and the tests/reference Git remotes like "git@github.com:Hu-Wentao/skills.git"), which will fetch and execute remote package code at runtime (e.g., installing/updating via pnpm), so these external repository references are runtime dependencies that can execute remote code.