skill-authoring
Warn
Audited by Snyk on Jul 20, 2026
Risk Level: MEDIUM
Full Analysis
MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).
- Potentially malicious external URL detected (high risk: 0.80). The repository includes npx install commands that fetch and execute remote packages (e.g., "npx skills add yikZero/skills" and "npx skills@latest add ..."), which will run remote code during install and thus represent a runtime external dependency (commands flagged: npx skills add yikZero/skills, npx skills@latest add . --list, npx yskill --skill skill-authoring).
Issues (1)
W012
MEDIUMUnverifiable external dependency detected (runtime URL that controls agent).
Audit Metadata