gh-setup

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The skill automatically runs "gh extension install sudosubin/gh-attach" at runtime (e.g., in scripts/gh_env.py, scripts/gh-env.mjs and the routing scripts), which causes the agent to fetch and install remote code from the referenced GitHub repository (sudosubin/gh-attach).