bioresearcher-onboard

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.70). The skill fetches a Node.js binary and installs npm packages (biomcp, webr, mysql2) from external URLs (nodejs.org, npmmirror.com, and registry.npmjs.org), constituting an operational dependency with weak/unverified checksum checks or dynamic mirror fallback.