elevenlabs-tts

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.70). The skill instructs installing and then invoking the external CLI package belt-sh/cli via npx skills add belt-sh/cli, which is executed through the allowed Bash(belt *) tool for all operational commands, yet this installer locator belongs to an unverified "belt-sh" org rather than the "inference.sh" brand the skill claims to use, making its publisher provenance unknown/weak.