google-directory

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The skill repeatedly invokes "npx @membranehq/cli@latest" at runtime (e.g., for login, connect, action run, and proxy requests), which fetches and executes remote code from the npm registry, so the Membrane CLI is a required runtime-executed external dependency.