pp-wavespeed

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.80). The skill documents on-demand installation commands that fetch and install remote binaries (which execute remote code) — notably the Go module installs github.com/mvanhorn/printing-press-library/library/ai/wavespeed/cmd/wavespeed-pp-cli@latest and github.com/mvanhorn/printing-press-library/library/ai/wavespeed/cmd/wavespeed-pp-mcp@latest, and the skill requires the installed CLI to run, so these are runtime external dependencies that execute remote code.