picgo-upload

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.70). The skill instructs installing the picgo package from npm (npm install picgo -g), which relies on an external package registry without an immutable identifier or cryptographic digest, constituting a weak runtime dependency.