Linear

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The skill's MCP configuration runs npx with the remote endpoint "https://mcp.linear.app/sse" (e.g., "args": ["mcp-remote", "https://mcp.linear.app/sse"]), which implies npx may fetch/execute the mcp-remote package at runtime and thus executes remote code from that URL.