related-skill

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.80). The skill document includes multiple npx install commands such as "npx skills add belt-sh/cli" and "npx skills add inference-sh/skills@ai-image-generation" which, when run, fetch and execute remote skill packages that can directly change agent behavior or instructions, so this is a runtime external dependency that can execute remote code.