ui-skills-root

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.80). This skill requires running "npx ui-skills" which at runtime fetches and executes the external "ui-skills" npm package (e.g. https://registry.npmjs.org/ui-skills), so remote code is executed and relied on to select/load skills.