publish-and-sync-skills

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The skill installation command (npx --yes skills@latest add JoelFrancisco/skills) fetches the repository JoelFrancisco/skills at runtime and installs skill files (e.g., agents/openai.yaml default_prompt and SKILL.md) that directly control model prompts.