app-icon-template-creator

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.70). The skill's workflow requires running "npm --prefix /scripts ci" which will fetch and install remote npm packages (e.g., https://registry.npmjs.org/ajv/-/ajv-8.20.0.tgz) that are executed by the template-lint script, so remote code is fetched and run at runtime.