create-skill

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.70). The instruction to run npx -y skills-ref validate path/to/skill invokes an unvetted remote package execution at runtime from an arbitrary unofficial source, creating a weak operational dependency.