pp-customer-io

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The skill requires fetching and executing remote code as a runtime dependency via the npx installer (npx -y @mvanhorn/printing-press install customer-io --cli-only) and via go install of the GitHub packages (github.com/mvanhorn/printing-press-library/.../customer-io/cmd/customer-io-pp-cli@latest and github.com/mvanhorn/printing-press-library/.../customer-io/cmd/customer-io-pp-mcp@latest), which clearly downloads and runs remote code that the skill depends on.