vulnerability-advisory-impact-brief

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The provided runner calls the external API endpoint https://ai-skills.ai/api/execute (DEFAULT_BASE_URL + /api/execute) at runtime to execute the skill (requiring AISKILLS_API_KEY), so execution and prompt handling are controlled by remote code/content on ai-skills.ai.