design-review-garrytan

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.80). The skill's runtime install step uses npx to fetch and execute remote code (via "npx skills add garrytan/gstack"), pulling the upstream repository https://github.com/garrytan/gstack which thus executes external code at runtime and is a required dependency.