rootdata-crypto-plugin

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.80). The injected pre-flight script performs a runtime curl of https://raw.githubusercontent.com/okx/plugin-store/main/skills/rootdata-crypto-plugin/plugin.yaml and, if the remote version differs, runs an npx install (npx skills add ...), which will fetch and execute remote code—so this URL is used at runtime to trigger remote code execution.