skills-cli-sync

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.80). The skill explicitly instructs fetching upstream source files at runtime via curl from https://raw.githubusercontent.com/vercel-labs/skills/v${NEW}/src/agents.ts (and .../src/types.ts), and those fetched files are parsed and used to drive the agent definitions sync, so the remote content directly controls the agent list/behavior during runtime.