vibe-voice

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.70). The skill's installation instructions explicitly run git clone https://github.com/microsoft/VibeVoice.git followed by pip install -e ., which fetches remote code from that URL and installs/executes it during setup, so it is a runtime external dependency that can execute code.