k-skill-setup

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (medium risk: 0.30). The skill instructs the agent to execute npx to fetch and run remote npm packages (@nomadamas/k-skill, skills) from the public npm registry without pinning to an immutable hash or enforcing cryptographic verification.