sync-ups

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The sync_upstream.py script fetches and writes from the remote repo https://github.com/majidmanzarpour/threejs-game-skills.git at runtime (it reads upstream blobs including prompt-templates.md and scripts and writes them into the local skills), so upstream content can directly control agent prompts and introduce executable code.