xhs-static-cards

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The skill's Step 0 precheck and installation instructions tell the agent to run npx to fetch and install remote skill packages (e.g. "npx skills add nexu-io/open-design@frontend-design", "npx skills add spencerpauly/awesome-cursor-skills@exporting-to-png", "npx skills add wundelai/skills@web-typography", and "npx skills add ztaihang/agent-skills@xhs-static-cards"), which are runtime installs of external code the agent may execute and which the skill explicitly requires to control templates/behavior.