next-bulk-move

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (medium risk: 0.30). The instruction mentions cloning from NextCommerceCo/skills and using npx skills add NextCommerceCo/skills, which are remote repository locators used during setup and runtime to obtain skill material.