nimbalyst-skills

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The skill directs users to install packages via npx (e.g., npx skills add nimbalyst/excalidraw) and points to the custom registry URL https://nimbalyst.com/skills, which will fetch and execute remote package code at install/runtime and thus can directly control agent behavior.