alibabacloud-devops

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The skill invokes npx/docker to fetch and execute required MCP packages at runtime (e.g., npx -y alibabacloud-devops-mcp-server@0.3.38 which pulls from an npm registry such as https://registry.npmmirror.com or the default npm registry, and the Docker image build-steps-public-registry.cn-beijing.cr.aliyuncs.com/build-steps/alibabacloud-devops-mcp-server:latest), so remote code is fetched and executed and is a required runtime dependency.