init-vercel-shop

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.80). The skill instructs running npx create-vercel-shop@latest and npx plugins add vercel/shop (and related npx plugin installs), which fetch and execute remote npm packages from the registry (e.g. https://registry.npmjs.org/create-vercel-shop and the plugin packages) at runtime and are required to initialize the project, so they constitute runtime external code execution.