jules

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The skill instructs installing the external npm package at runtime via "npm install -g @google/jules", which fetches and executes remote code (the Jules CLI) that the skill then relies on to create sessions and perform agentic actions, thus giving the external package control over prompts/execution.