extract-design-md

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The SKILL includes an explicit setup step that runs "npx skills add google-labs-code/stitch-skills" which fetches and executes remote code from the upstream repository https://github.com/google-labs-code/stitch-skills during installation, and that fetched code would control the agent's skill behavior and prompts.