walkthrough-record

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.80). The skill's setup/install step fetches npm packages (which will be executed as runtime dependencies) from the npm registry (e.g. https://registry.npmjs.org/playwright/-/playwright-1.61.1.tgz and related package URLs in scripts/package-lock.json) when running scripts/setup.sh / npm install, so remote code is downloaded and used by the recorder.