pp-shopper

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The skill includes go install lines that fetch and compile remote code at setup—github.com/mvanhorn/printing-press-library/library/commerce/shopper/cmd/shopper-pp-cli@latest and github.com/mvanhorn/printing-press-library/library/commerce/shopper/cmd/shopper-pp-mcp@latest—which will download and build/execute third-party code required for the CLI, so this is a runtime external dependency that can execute remote code.