security-scan

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 1.00). The skill explicitly runs npx/npm install (e.g., "npx ecc-agentshield", "npm install -g ecc-agentshield") and declares a GitHub Action "uses: affaan-m/agentshield@v1", which will fetch and execute remote code from https://www.npmjs.com/package/ecc-agentshield and https://github.com/affaan-m/agentshield at runtime, so these URLs are runtime external dependencies that execute remote code.