project-bootstrap
Warn
Audited by Snyk on Jul 4, 2026
Risk Level: MEDIUM
Full Analysis
MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).
- Potentially malicious external URL detected (high risk: 0.90). The skill explicitly installs a remote project-local agent via npx at runtime (npx skills@latest add yikZero/skills --skill find-docs -a codex -y), which fetches code from the external yikZero/skills repository into .agents/skills/find-docs — a required dependency that can contain executable skill logic and directly influence agent prompts/behavior.
Issues (1)
W012
MEDIUMUnverifiable external dependency detected (runtime URL that controls agent).
Audit Metadata