thoughtspot

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (medium risk: 0.30). The skill instructs the installation and execution of an npm package from the public registry (@membranehq/cli), which is a common third-party transporter without a strict cryptographic digest, but represents a reputable vendor/tool integration.