agent-starter-kit

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.70). The install script executes npx -y skills add using multiple external GitHub repository locators (vercel-labs/skills, vercel-labs/agent-browser, forrestchang/andrej-karpathy-skills, nextlevelbuilder/ui-ux-pro-max-skill, juliusbrussee/caveman, and obra/superpowers) whose publishers lack strong first-party verification, representing weak/unknown/suspicious operational dependencies.