unsloth-workflows

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.70). An operational dependency exists because the skill downloads and installs Python packages (such as unsloth) via uv from public package registries during environment setup (scripts/environment.py and SKILL.md), lacking cryptographic integrity guarantees, which falls under a weak/unknown/suspicious provenance tier.