ai-music-generation

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.70). The skill instructs installing a separate "belt" CLI via npx skills add belt-sh/cli, a GitHub-style repository locator whose code is installed and then executed for every music-generation command, but "belt-sh" has no established vendor/ownership evidence, making this an unverifiable weak/unknown inbound dependency (high tier), which outranks the more credible self-referential inference-sh/skills install-instructions link.