mcp-security-hub

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The skill explicitly instructs cloning and running code from the remote repository (git clone https://github.com/FuzzingLabs/mcp-security-hub) and then building/running those Dockerized servers, meaning external code from that URL is fetched and executed and can directly control agent behavior.