space-chart-html-plus

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 1.00). The skill explicitly runs a runtime command "npx getdesign@latest add " to fetch and execute a remote npm package and then reads the generated DESIGN.md to extract CSS tokens that directly control the agent's output (brand style), which constitutes remote code execution and a required runtime dependency.