book-writer

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.70). The skill instructs the agent to run an external command (npx skills add ...) that fetches and installs external packages from a GitHub repository (https://github.com/kshanxs/skill-dojo) during initialization, constituting an unverifiable runtime external operational dependency with weak provenance.