react-hook-form-audit

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (medium risk: 0.30). The skill executes npm install inside scripts/ to fetch ts-morph from the default npm registry during first-run setup, creating an unauthenticated third-party operational dependency.