skill-creator-primer

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.70). An operational dependency exists when a URL or locator is fetched at setup or runtime and supplies code or instructions the skill executes or adopts; here, git URLs in python script dependencies (such as skills-ref in scripts/validate_skill.py) are fetched at runtime via uv, establishing a weak/unknown/suspicious operational dependency because they bypass standard package registries and rely on unverified direct git repositories.