kickoff-patch

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The skill explicitly shells out to fetch a base tag at runtime via "git clone --depth 1 --branch https://github.com/cleaniquecoders/kickoff.git", and the cloned stubs/src (notably src/StartCommand.php) are diffs/parsed at runtime to drive composer/npm/vendor:publish/artisan commands — i.e. remote code/content from https://github.com/cleaniquecoders/kickoff.git directly controls actions executed by the tool.