init-project

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The skill instructs running the external CLI via "npx @claude-flow/cli@latest init --wizard", which causes npx to fetch and execute remote package code at runtime and that package creates/controls agent instruction files (e.g., CLAUDE.md), so it is a runtime dependency that can directly control prompts.