html-lint-runner

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.70). The wrapper script's ensure_setup step runs "pnpm install --filter html-lint-runner" (which contacts the npm registry) and the package's postinstall runs "npx playwright install chromium" (which downloads and executes Playwright's installer / browser binaries from Playwright's CDN), so the skill may fetch and execute remote code/assets at runtime (npm/Playwright endpoints such as https://registry.npmjs.org/ and Playwright's download CDN).