skill-sync

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.95). APM installs fetch GitHub repositories at runtime (e.g., github.com/loxosceles/{repo}), and those repos (like loxosceles-dev/dev-skills and loxosceles/guitarizta-skills) contain agent JSON and SKILL.md files which directly control agent prompts/behavior, so remote content downloaded during install can change agent instructions.