fizz

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The skill's Step 3 x‑ray Acquisition Protocol explicitly runs a runtime git clone of https://github.com/pashov/skills.git and then installs/invokes the fetched skill (copying and executing its SKILL.md/tool instructions), so remote content from that URL is fetched at runtime and can control agent behavior or execution.