market-event-impact

CRITICAL E005: Suspicious download URL detected in skill instructions.

• Suspicious download URL detected (medium risk: 0.30). The skill directs the user to run npx to download and execute code from @nomadamas/k-skill, an external npm package whose source code is not bundled within the repository.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.70). The instruction mandates running an external npx command (npx -y @nomadamas/k-skill@0 ...) at setup/runtime to fetch instructions and code from npm, which constitutes an unverifiable runtime external dependency from an unverified third-party publisher.