base44-remote-dev

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.80). The skill explicitly uses the runtime MCP API endpoint https://app.base44.com/mcp (registered with "claude mcp add" and used for tool calls) which exposes run_command to execute arbitrary shell commands in the sandbox, and also references a public readme URL (https://app.base44.com/api/sandbox/<APP_ID>/local-agent/readme.md) that an agent can fetch at runtime to drive its behavior, so external content is used at runtime to execute code and to control prompts.