lean-core-usage

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The skill explicitly instructs the agent to fetch and read marketplace.json and the README from https://github.com/leancodepl/ai-plugins at runtime and to base its responses on that fetched content, so external content will directly control the agent's prompts.