lovstudio-cc-mv

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The skill invokes npx to fetch-and-run remote npm packages at runtime (e.g. "npx -y @lovstudio/cc-mv" and the alias "npx -y @lovstudio/cc-migrate-session"), which downloads and executes external code that directly controls the migration behavior, so this is a runtime external dependency that can execute remote code.