soia-dev-coding-protocol

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The installation command "npx skills add soia-team/soia-open-dev-coding-skills -g -a '*' -s soia-dev-coding-protocol -y" (line 23) fetches and executes a remote npm package at install/runtime, so the fetched code can control the agent's behavior and is a required dependency.