toss-investment
Warn
Audited by Snyk on Aug 17, 2026
Risk Level: MEDIUM
Full Analysis
MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).
- Potentially malicious external URL detected (high risk: 1.00). SKILL.md explicitly tells the user to run "npx -y @nomadamas/k-skill@0 instruct toss-investment", which causes npx to fetch and execute the remote @nomadamas/k-skill package at runtime and thereby control the skill's instructions (see fallback/source instructions at https://github.com/NomaDamas/k-skill/blob/main/toss-investment/instruction.md).
Issues (1)
W012
MEDIUMUnverifiable external dependency detected (runtime URL that controls agent).
Audit Metadata