site-generation

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The skill tells the agent to run "npx -y skills add vercel-labs/agent-skills --skill react-best-practices --skill web-design-guidelines --skill composition-patterns -y", which will fetch and execute remote code and then instruct the agent to read and apply the installed SKILL.md files (i.e., external content that directly controls generation rules), so this is a runtime external dependency that can control prompts.