pp-lunch-money

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.70). The skill instructs the agent to install a package from npm (@mvanhorn/printing-press-library) and go install from GitHub (github.com/mvanhorn/printing-press-library/...), which are third-party/unofficial dependencies under the author's individual repository rather than recognized official publisher provenance, triggering a high-risk tier.