pp-here-now

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.80). The skill includes runtime installation commands that fetch and execute remote code (e.g., npx -y @mvanhorn/printing-press-library install here-now and go install github.com/mvanhorn/printing-press-library/library/cloud/here-now/cmd/here-now-pp-cli@latest — and the MCP install go install github.com/mvanhorn/printing-press-library/library/cloud/here-now/cmd/here-now-pp-mcp@latest), so the agent may execute externally-fetched code as a required dependency.