jfrog-ai-catalog

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The skill runs npx to fetch and execute the @jfrog/agent-guard package at runtime and defaults the npm registry to https://releases.jfrog.io/artifactory/api/npm/coding-agents-npm/, which means remote code is fetched and executed as a required dependency.