skill-file-security

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (medium risk: 0.30). The skill references an npm package locator (@netxeo/security-skill) executed via npx during setup/runtime to install security instruction files, and the publisher Netxeo lacks strong first-party verification, classifying it as a medium-tier unofficial operational dependency.