korean-cinema-search

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The skill instructs running npx --yes daiso (fetching and executing the remote npm package at https://www.npmjs.com/package/daiso) and offers a fallback to git clone https://github.com/hmmhmmhm/daiso-mcp.git followed by npm install/build and node dist/bin.js, which clearly fetches and executes external code at runtime that the skill depends on.