compose-design-catalog

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.70). The instructions mention running a remote install script (curl -fsSL https://raw.githubusercontent.com/yschimke/skills/main/scripts/install.sh | bash) and fetching skills via npx skills add yschimke/skills, which constitute inbound operational dependencies retrieved from a repository.