architect

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.80). The skill explicitly runs runtime discovery and install commands (for example npx skills find <tool-or-package> and npx skills add <owner>/<repo> -y) and spawns a web-researcher subagent to fetch pages at runtime, which can fetch and execute remote code or install Agent Skills that change agent behavior.