task-observer

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.80). The skill explicitly instructs the agent to fetch the public repo documentation at runtime (e.g., https://github.com/rebelytics/one-skill-to-rule-them-all/blob/main/README.md and https://github.com/rebelytics/one-skill-to-rule-them-all/blob/main/USER-GUIDE.md), and those fetched docs are treated as the "source of truth" for user-facing instructions — meaning remote content would directly control prompts/instructions during execution.