simready-foundation-create-package

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.80). The setup_venv.sh script and requirements-package-sample.txt explicitly use https://pypi.nvidia.com/ as the pip index (and setup_venv.sh allows additional --extra-index URLs), which will be contacted at setup time to download and install packages that the skill then imports and executes, making this an in-runtime external dependency (https://pypi.nvidia.com/).