mj-skill-creator

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The skill repeatedly instructs running the external installer command "npx skills add makerjackie/skills --skill " which at runtime fetches the remote makerjackie/skills package (e.g. from the npm registry) and installs SKILL.md / agents/openai.yaml files that directly control agent prompts and are required for the workflow, so this is a runtime external dependency that can change agent instructions.