review-document

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.70). The skill instructs the execution of external commands (vp dlx) to fetch and run remote packages (comark-linter, comark-ui) from the Vite+ ecosystem without strong official cryptographic provenance or fixed digests, constituting a weak runtime operational dependency.