designer-handoff

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.80). The skill explicitly runs package-install and fetch commands that retrieve and execute remote code used at runtime—e.g., npm install -g ui-ux-pro-max-cli && uipro init --ai opencode --global and npx skills add -g -y nutlope/hallmark—so external content fetched here can control agent behavior or execute code.