agent-starter-kit

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). install.sh invokes npx at runtime to fetch and install remote skill repositories (e.g., "vercel-labs/skills|find-skills"), which pulls and installs remote code that can control agent behavior.