skill-publishing

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 1.00). The documentation states that npx skills add git-clones repositories at runtime and gives the explicit example git URL git@github.com:owner/repo.git, so remote SKILL.md and sibling scripts (which can control prompts or be executed) will be fetched and used during runtime.