pp-forgejo

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 1.00). The skill's setup explicitly runs remote installers that fetch and execute code at runtime—e.g. "npx -y @mvanhorn/printing-press-library install forgejo --cli-only" and "go install github.com/mvanhorn/printing-press-library/library/developer-tools/forgejo/cmd/forgejo-pp-cli@latest" (and the similar go install for forgejo-pp-mcp@latest)—so external content from those locations is required and can directly control the agent's runtime behavior.