training-lecture-recap

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.80). The SKILL.md contains an install command that downloads-and-runs remote code — "npx skills add https://github.com/peter-tu-zynkr/zynkr-skill-builder --skill training-lecture-recap" — which fetches and executes code from that GitHub URL during installation and could therefore control agent behavior.