kg-pack

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The skill instructs cloning and then running scripts from the remote repository https://github.com/rysweet/agent-kgpacks.git (git clone ... && uv sync; later uv run python scripts/install_pack_skills.py), which fetches and executes code that installs skills and thus can directly control agent prompts and behavior.