ratings-snapshot

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (medium risk: 0.30). The skill references an external MCP server package (npx -y octagon-mcp@latest) executed locally via Node.js, which constitutes a runtime dependency on an npm package retrieved from the public registry without a fixed immutable identifier or signature.