soia-meta-skill-release

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.80). The skill invokes runtime commands that fetch and install remote repository content (e.g. "npx skills add soia-team/soia-open-skills" and a gh api call against repos/soia-team/soia-open-skills/contents/...), so the repository reference "soia-team/soia-open-skills" is used at runtime to fetch and install remote skill code that will be executed by agents.