gsd-agents

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The skill includes a CLI fallback that runs remote code at runtime (e.g., the documentation_lookup uses npx --yes ctx7@latest library <name> / npx --yes ctx7@latest docs <libraryId> "<query>"), which fetches and executes an external npm package to produce content the agent then uses for prompt/doc lookup — a runtime remote-code execution dependency.