huawei-cloud-find-skills

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The skill explicitly instructs fetching skill documentation at runtime from raw.githubusercontent.com (e.g. https://raw.githubusercontent.com/huaweicloud/huaweicloud-skills/master/skills/${category}/${service}/${name}/SKILL.md) and installing code via npx/git (e.g. https://gitcode.com/huaweicloud/huaweicloud-skills.git#master and the GitHub repo https://github.com/huaweicloud/huaweicloud-skills), which are runtime fetches of remote content that can directly control agent instructions or execute remote code.