design-brief

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.70). The skill instructs runtime installation via an npx skills add command pulling a remote raw GitHub URL, representing an unverified unofficial or arbitrary third-party repository dependency (tier high).