3devkit

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The skill's install instructions explicitly tell users to fetch and run remote code for gstack (git clone --depth 1 https://github.com/garrytan/gstack.git ~/.cursor/skills/gstack && cd ~/.cursor/skills/gstack && ./setup), which both executes remote code during setup and installs prompt-controlling skill content that the agent depends on.