ground-truth

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (medium risk: 0.30). The README file contains an npx install instruction fetching an external repository (looties-io/looties-skills), which constitutes an operational dependency with common unofficial provenance.