pp-calendly

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The skill's prerequisite installation steps fetch and execute remote code (via "npx -y @mvanhorn/printing-press-library install calendly --cli-only" and "go install github.com/mvanhorn/printing-press-library/library/productivity/calendly/cmd/calendly-pp-cli@latest" / ".../calendly-pp-mcp@latest"), so these external package/module references are runtime dependencies that install and run remote code.